kxco-verify 1.3.0 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/README.md +105 -82
- package/package.json +10 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.3.1
|
|
4
|
+
|
|
5
|
+
Documentation. No source change.
|
|
6
|
+
|
|
7
|
+
**The npm page leads with what the package proves.** The first screen now says
|
|
8
|
+
what a verification checks and where it runs: in a browser or a terminal, from
|
|
9
|
+
the artefact alone, with no KXCO server in the trust path, on the
|
|
10
|
+
`@noble/post-quantum` release NIST's vectors pass, alongside the migration dates
|
|
11
|
+
set by NIST, Executive Order 14412, OMB M-26-15 and the UK NCSC.
|
|
12
|
+
|
|
13
|
+
A family table maps every KXCO package to the job it does, and a new For
|
|
14
|
+
institutions section sets out the operated services and how to reach us. The
|
|
15
|
+
evidence documents are unchanged and linked from the page.
|
|
16
|
+
|
|
17
|
+
The examples run as written. The command line and the quick start verify the
|
|
18
|
+
live attestation at target150.com, and the browser import map maps each package
|
|
19
|
+
folder so the library loads in a browser. The page gives the supported runtime
|
|
20
|
+
as Node.js 20.19 and later, and the fetch defaults as 3000 ms per request and
|
|
21
|
+
200,000 bytes.
|
|
22
|
+
|
|
3
23
|
## 1.3.0
|
|
4
24
|
|
|
5
25
|
Additive. The library is byte-for-byte unchanged: same one dependency, same
|
package/README.md
CHANGED
|
@@ -1,41 +1,37 @@
|
|
|
1
1
|
# kxco-verify
|
|
2
2
|
|
|
3
|
+
**Verify a KXCO post-quantum signature in any browser or terminal, from the artefact alone, with no KXCO server in the trust path.**
|
|
4
|
+
|
|
3
5
|
[](https://www.npmjs.com/package/kxco-verify)
|
|
6
|
+
[](https://www.npmjs.com/package/kxco-verify)
|
|
7
|
+
[](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md)
|
|
8
|
+
[](https://www.npmjs.com/package/kxco-verify)
|
|
4
9
|
[](https://socket.dev/npm/package/kxco-verify)
|
|
5
10
|
[](./LICENSE)
|
|
6
11
|
[](https://nodejs.org)
|
|
7
12
|
[](https://verify.kxco.ai)
|
|
8
13
|
|
|
9
|
-
Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-65 signed documents.
|
|
14
|
+
Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 20.19 and later.
|
|
10
15
|
|
|
11
|
-
|
|
16
|
+
- **No KXCO server in the trust path.** `verifyManifest()` makes no network request at all, and `verifyUrl()` contacts only the attestation URL you pass and the key endpoint the manifest names.
|
|
17
|
+
- **Runs in the browser as shipped.** No `Buffer`, no `process` and SHA-256 from WebCrypto, which is how [verify.kxco.ai](https://verify.kxco.ai) checks a signature entirely in the tab.
|
|
18
|
+
- **Catches key rotation.** `verifyUrl()` compares the signing key with the one the site serves now and reports `rotated`, a state of its own, so a site mid-rotation is never mistaken for a forgery.
|
|
19
|
+
- **Live revocation on request.** `--live` asks the KXCO key registry whether the signing kid is still active, and fails closed.
|
|
20
|
+
- **Made for CI.** `npx kxco-verify <url>` exits 0 for valid, 1 for invalid or revoked, 2 when it cannot fetch or parse and 3 for rotated, with `--json` for machines.
|
|
21
|
+
- **Independent of the signer.** It calls the primitive directly and shares none of the KXCO signing code, so it can be audited on its own.
|
|
22
|
+
- **The primitive NIST's vectors pass.** Verification runs `@noble/post-quantum` 0.7.0, pinned exactly: the version [`kxco-post-quantum`](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md) holds to 1,793 NIST ACVP vectors passed, 0 failed, and 225 interoperability checks against liboqs, Bouncy Castle and the Python reference implementations, 0 failed.
|
|
12
23
|
|
|
13
|
-
|
|
24
|
+
**The migration has dates.**
|
|
25
|
+
|
|
26
|
+
- **NIST** published [FIPS 203](https://csrc.nist.gov/pubs/fips/203/final), [FIPS 204](https://csrc.nist.gov/pubs/fips/204/final) and [FIPS 205](https://csrc.nist.gov/pubs/fips/205/final) in August 2024.
|
|
27
|
+
- **United States:** [Executive Order 14412](https://www.federalregister.gov/documents/2026/06/25/2026-12909/securing-the-nation-against-advanced-cryptographic-attacks), signed on 22 June 2026, moves federal high-value and high-impact systems to post-quantum key establishment by 31 December 2030 and to post-quantum signatures by 31 December 2031. [OMB M-26-15](https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf) requires PQC-agile libraries for all new applications.
|
|
28
|
+
- **United Kingdom:** the [NCSC](https://www.ncsc.gov.uk/guidance/pqc-migration-timelines) sets 2028, 2031 and 2035 as its migration milestones.
|
|
14
29
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
- **Provenance.** Each release carries a SLSA provenance attestation tying the
|
|
18
|
-
published tarball to the commit and workflow that built it. Verify with
|
|
19
|
-
`npm audit signatures`, or read it directly from
|
|
20
|
-
`registry.npmjs.org/-/npm/v1/attestations/kxco-verify@<version>`.
|
|
21
|
-
- **Bill of materials.** A CycloneDX SBOM is published as a GitHub Release asset
|
|
22
|
-
at `releases/download/v<version>/sbom.cyclonedx.json`, a permanent
|
|
23
|
-
unauthenticated URL. Not an expiring build artifact.
|
|
24
|
-
- **Pinned, not floated.** Every runtime dependency is pinned to an exact
|
|
25
|
-
version, never a range, so the code that performs the cryptography cannot
|
|
26
|
-
change without a release of this package. Every GitHub Action is pinned by
|
|
27
|
-
40-character commit SHA.
|
|
28
|
-
- **Conformance.** The primitives are the same ones run against **2,103 NIST
|
|
29
|
-
ACVP vectors (0 failed)** and a **225-check cross-implementation
|
|
30
|
-
interoperability matrix** in
|
|
31
|
-
[`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum),
|
|
32
|
-
against liboqs, Bouncy Castle and two pure-Python implementations. This
|
|
33
|
-
package deliberately shares no code with the signer: a verifier that reached
|
|
34
|
-
the primitives through the same wrapper would be checking its own work.
|
|
30
|
+
[Quick start](#quick-start) · [Command line](#command-line) · [Browser usage](#browser-usage) · [For institutions](#for-institutions) · [Changelog](./CHANGELOG.md) · [kxco.ai](https://kxco.ai)
|
|
35
31
|
|
|
36
32
|
## When to use this
|
|
37
33
|
|
|
38
|
-
This package is for the **receiving end** of a KXCO signed attestation
|
|
34
|
+
This package is for the **receiving end** of a KXCO signed attestation: anyone who needs to confirm that a signature is genuine without being a KXCO institution or running the full SDK.
|
|
39
35
|
|
|
40
36
|
Use this if you are:
|
|
41
37
|
|
|
@@ -45,9 +41,7 @@ Use this if you are:
|
|
|
45
41
|
- Writing a minimal verification script with no heavy dependencies
|
|
46
42
|
- An end user who wants to verify a credential independently, without trusting any intermediary server
|
|
47
43
|
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
---
|
|
44
|
+
To **sign** attestations, pick the signing package from [the KXCO post-quantum family](#the-kxco-post-quantum-family).
|
|
51
45
|
|
|
52
46
|
## Install
|
|
53
47
|
|
|
@@ -55,20 +49,18 @@ If you need to **sign** attestations, see the packages listed under [Part of the
|
|
|
55
49
|
npm install kxco-verify
|
|
56
50
|
```
|
|
57
51
|
|
|
58
|
-
Node
|
|
59
|
-
|
|
60
|
-
---
|
|
52
|
+
Node.js 20.19 and later. ESM only. One dependency, and no KXCO server in the trust path.
|
|
61
53
|
|
|
62
54
|
## Command line
|
|
63
55
|
|
|
64
56
|
```bash
|
|
65
|
-
npx kxco-verify https://
|
|
57
|
+
npx kxco-verify https://www.target150.com/api/attestation
|
|
66
58
|
```
|
|
67
59
|
|
|
68
60
|
```
|
|
69
|
-
VALID
|
|
61
|
+
VALID target150.com
|
|
70
62
|
algorithm ML-DSA-65
|
|
71
|
-
kid
|
|
63
|
+
kid 680f9af0bb44de3f
|
|
72
64
|
|
|
73
65
|
This means the site signed its own manifest with a key it published.
|
|
74
66
|
It is not an endorsement of the site, its owner, or its content.
|
|
@@ -80,7 +72,7 @@ Exit codes are meant for CI: **0** valid, **1** invalid or revoked, **2** could
|
|
|
80
72
|
|
|
81
73
|
### `--live`
|
|
82
74
|
|
|
83
|
-
A signature
|
|
75
|
+
A signature stays mathematically valid after its key is revoked, so `--live` asks the KXCO key registry whether the signing kid is still active:
|
|
84
76
|
|
|
85
77
|
```bash
|
|
86
78
|
npx kxco-verify https://example.com/.well-known/kxco-pq-attestation --live
|
|
@@ -92,11 +84,11 @@ VALID example.com
|
|
|
92
84
|
registry revoked
|
|
93
85
|
```
|
|
94
86
|
|
|
95
|
-
That exits **1
|
|
87
|
+
That exits **1**: the signature verifies, the registry reports the key revoked, and `--live` reports both facts.
|
|
96
88
|
|
|
97
|
-
`--live` **fails closed**: if the registry cannot be reached, the result is not valid
|
|
89
|
+
`--live` **fails closed**: if the registry cannot be reached, the result is not valid, so a check that could not run never reads as a pass.
|
|
98
90
|
|
|
99
|
-
It
|
|
91
|
+
It uses [`kxco-pq-network`](https://www.npmjs.com/package/kxco-pq-network), an **optional** peer dependency, so the default install stays at one dependency. Add it when you want the flag:
|
|
100
92
|
|
|
101
93
|
```bash
|
|
102
94
|
npm install kxco-pq-network
|
|
@@ -104,9 +96,7 @@ npm install kxco-pq-network
|
|
|
104
96
|
|
|
105
97
|
Registry base URL defaults to `https://chain.kxco.ai` and can be changed with `--registry`. A licence key, via `--licence` or `KXCO_LICENCE_KEY`, meters the reads; reads without one are allowed and rate-limited.
|
|
106
98
|
|
|
107
|
-
Everything above the `--live` heading works offline, forever, with no account and no licence.
|
|
108
|
-
|
|
109
|
-
---
|
|
99
|
+
Everything above the `--live` heading works offline, forever, with no account and no licence.
|
|
110
100
|
|
|
111
101
|
## Quick start
|
|
112
102
|
|
|
@@ -128,7 +118,7 @@ If you already have the manifest body in hand (from a prior fetch, a file, or us
|
|
|
128
118
|
```js
|
|
129
119
|
import { verifyManifest } from 'kxco-verify'
|
|
130
120
|
|
|
131
|
-
const body = await fetch('https://
|
|
121
|
+
const body = await fetch('https://www.target150.com/api/attestation').then(r => r.text())
|
|
132
122
|
const result = await verifyManifest(body)
|
|
133
123
|
```
|
|
134
124
|
|
|
@@ -137,13 +127,31 @@ const result = await verifyManifest(body)
|
|
|
137
127
|
| `state` | Meaning |
|
|
138
128
|
|---|---|
|
|
139
129
|
| `"valid"` | Signature checks out against the manifest-declared key, and that key matches the live well-known endpoint. |
|
|
140
|
-
| `"rotated"` | Signature checks out, but the live well-known endpoint now serves a different key. The site is mid key-rotation
|
|
130
|
+
| `"rotated"` | Signature checks out, but the live well-known endpoint now serves a different key. The site is mid key-rotation: retry shortly. |
|
|
141
131
|
| `"invalid"` | The signature does not verify under the manifest-declared key, or the key identifier is inconsistent with the published key bytes. |
|
|
142
132
|
| `"error"` | The verifier could not run: network failure, malformed JSON, or unsupported algorithm. |
|
|
143
133
|
|
|
144
|
-
A `"valid"` result
|
|
134
|
+
A `"valid"` result is a precise cryptographic statement: the site signed this manifest with the key it publishes. Who operates the site is a separate question, covered in [`docs/threat-model.md`](./docs/threat-model.md).
|
|
135
|
+
|
|
136
|
+
## For institutions
|
|
137
|
+
|
|
138
|
+
The cryptography is free under Apache-2.0, works offline and needs nothing from
|
|
139
|
+
KXCO, now or in ten years. What KXCO sells is the part that has to be operated:
|
|
140
|
+
an answer about the present.
|
|
141
|
+
|
|
142
|
+
| Service | What you get |
|
|
143
|
+
|---|---|
|
|
144
|
+
| Hosted key registry | Whether a key is active, revoked or rotated, answered at verification time |
|
|
145
|
+
| Meta-transaction relay | KXCO validates your signed intent, pays the gas and submits it, so you never hold a token or run a node |
|
|
146
|
+
| On-chain anchoring | A timestamp on Armature L1 that the chain itself has verified |
|
|
147
|
+
| Live revocation | `anchored+live` verification, which confirms the signing key is still trusted now |
|
|
148
|
+
| Support and SLA | Availability commitments, an escalation path and a named contact |
|
|
149
|
+
|
|
150
|
+
Priced in USD, per seat, per year. No tokens, no nodes and no wallets. The line
|
|
151
|
+
between free and paid is set out in
|
|
152
|
+
[LICENCE-PRODUCT.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/LICENCE-PRODUCT.md).
|
|
145
153
|
|
|
146
|
-
|
|
154
|
+
**Talk to us: [admin@kxco.ai](mailto:admin@kxco.ai)** · [kxco.ai](https://kxco.ai)
|
|
147
155
|
|
|
148
156
|
## API
|
|
149
157
|
|
|
@@ -157,8 +165,8 @@ Fetches the attestation at `attestationUrl`, verifies the ML-DSA-65 signature, t
|
|
|
157
165
|
verifyUrl(
|
|
158
166
|
attestationUrl: string,
|
|
159
167
|
opts?: {
|
|
160
|
-
timeoutMs?: number // default
|
|
161
|
-
maxBytes?: number // max response size to accept
|
|
168
|
+
timeoutMs?: number // per request, default 3000
|
|
169
|
+
maxBytes?: number // max response size to accept, default 200000
|
|
162
170
|
fetchImpl?: typeof fetch // override the fetch implementation
|
|
163
171
|
skipLivePubkey?: boolean // skip rotation check (no live fetch)
|
|
164
172
|
}
|
|
@@ -167,7 +175,7 @@ verifyUrl(
|
|
|
167
175
|
|
|
168
176
|
### `verifyManifest(manifestBody) → Promise<VerifyResult>`
|
|
169
177
|
|
|
170
|
-
Verify a manifest you already have. Accepts a raw JSON string or a parsed object.
|
|
178
|
+
Verify a manifest you already have. Accepts a raw JSON string or a parsed object. Makes no network requests, so the result is `"valid"`, `"invalid"`, or `"error"`, and `"rotated"` belongs to `verifyUrl`.
|
|
171
179
|
|
|
172
180
|
```ts
|
|
173
181
|
verifyManifest(manifestBody: string | object): Promise<VerifyResult>
|
|
@@ -247,20 +255,20 @@ bytesToHex(bytes: Uint8Array): string
|
|
|
247
255
|
hexEquals(a: string, b: string): boolean
|
|
248
256
|
```
|
|
249
257
|
|
|
250
|
-
---
|
|
251
|
-
|
|
252
258
|
## Browser usage
|
|
253
259
|
|
|
254
|
-
The library is browser-safe by construction. It uses no `Buffer
|
|
260
|
+
The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js 20.19 and later provide.
|
|
255
261
|
|
|
256
|
-
Use a bundler (Vite, esbuild, Rollup, webpack), or load as ESM via an import map:
|
|
262
|
+
Use a bundler (Vite, esbuild, Rollup, webpack), or load as ESM via an import map that points each package at its folder:
|
|
257
263
|
|
|
258
264
|
```html
|
|
259
265
|
<script type="importmap">
|
|
260
266
|
{
|
|
261
267
|
"imports": {
|
|
262
|
-
"@noble/post-quantum/
|
|
263
|
-
"
|
|
268
|
+
"@noble/post-quantum/": "/lib/@noble/post-quantum/",
|
|
269
|
+
"@noble/curves/": "/lib/@noble/curves/",
|
|
270
|
+
"@noble/hashes/": "/lib/@noble/hashes/",
|
|
271
|
+
"kxco-verify": "/lib/kxco-verify/src/index.js"
|
|
264
272
|
}
|
|
265
273
|
}
|
|
266
274
|
</script>
|
|
@@ -271,54 +279,69 @@ Use a bundler (Vite, esbuild, Rollup, webpack), or load as ESM via an import map
|
|
|
271
279
|
</script>
|
|
272
280
|
```
|
|
273
281
|
|
|
274
|
-
This is how [verify.kxco.ai](https://verify.kxco.ai) works
|
|
282
|
+
This is how [verify.kxco.ai](https://verify.kxco.ai) works: the browser fetches the manifest directly and runs the maths in the tab, with no KXCO server in between.
|
|
275
283
|
|
|
276
|
-
|
|
284
|
+
## The KXCO post-quantum family
|
|
277
285
|
|
|
278
|
-
|
|
286
|
+
This is the receiving end: given an artefact and a public key, is the signature
|
|
287
|
+
valid. Browser-safe, offline, with no server in the path, which is what lets an
|
|
288
|
+
auditor confirm something years after it was issued. The rest of the family
|
|
289
|
+
covers the jobs around it:
|
|
279
290
|
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
291
|
+
| You need to | Install |
|
|
292
|
+
|---|---|
|
|
293
|
+
| Put the whole stack in one install | [`kxco-pq`](https://www.npmjs.com/package/kxco-pq) |
|
|
294
|
+
| Use ML-DSA, ML-KEM and SLH-DSA directly | [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum) |
|
|
295
|
+
| Keep signing keys on the HSM you already run | [`kxco-pq-hsm`](https://www.npmjs.com/package/kxco-pq-hsm) |
|
|
296
|
+
| Sign a document or record anyone can verify offline | [`kxco-pq-attest`](https://www.npmjs.com/package/kxco-pq-attest) |
|
|
297
|
+
| Keep a tamper-evident audit trail | [`kxco-pq-audit`](https://www.npmjs.com/package/kxco-pq-audit) |
|
|
298
|
+
| Verify a signature in a browser, with no server | [`kxco-verify`](https://www.npmjs.com/package/kxco-verify) |
|
|
299
|
+
| Issue institution identity credentials | [`kxco-pq-sdk`](https://www.npmjs.com/package/kxco-pq-sdk) |
|
|
300
|
+
| Encrypt files and payloads to one or many recipients | [`kxco-pq-vault`](https://www.npmjs.com/package/kxco-pq-vault) |
|
|
301
|
+
| Encrypt Node streams and WebSockets | [`kxco-pq-tls`](https://www.npmjs.com/package/kxco-pq-tls) |
|
|
302
|
+
| Sign and verify webhooks | [`kxco-post-quantum-webhook`](https://www.npmjs.com/package/kxco-post-quantum-webhook) |
|
|
303
|
+
| Give an AI agent an identity a verified institution sponsors | [`kxco-pq-agent`](https://www.npmjs.com/package/kxco-pq-agent) |
|
|
304
|
+
| Have Armature L1 verify a signature in consensus | [`kxco-pq-chain`](https://www.npmjs.com/package/kxco-pq-chain) |
|
|
305
|
+
| Prove an envelope at three levels, offline to on-chain | [`kxco-pq-network`](https://www.npmjs.com/package/kxco-pq-network) |
|
|
306
|
+
| Generate and rotate keys from a terminal | [`kxco-pq-cli`](https://www.npmjs.com/package/kxco-pq-cli) |
|
|
307
|
+
| Find quantum-vulnerable cryptography in a dependency tree | [`kxco-pq-scan`](https://www.npmjs.com/package/kxco-pq-scan) |
|
|
308
|
+
| Fail the build when code reaches past the wrapper | [`eslint-plugin-kxco-pq`](https://www.npmjs.com/package/eslint-plugin-kxco-pq) |
|
|
309
|
+
|
|
310
|
+
The verifier is architecturally independent of the signer: it calls the primitive directly and shares none of the KXCO signing code. That separation makes this package auditable in isolation: a change to the signing pipeline leaves the verifier untouched.
|
|
287
311
|
|
|
288
|
-
##
|
|
312
|
+
## Release integrity
|
|
289
313
|
|
|
290
|
-
|
|
314
|
+
Every release since 1.2.1 carries a SLSA provenance attestation tying the published tarball to
|
|
315
|
+
the commit and workflow that built it: verify with `npm audit signatures`, or read
|
|
316
|
+
it from `registry.npmjs.org/-/npm/v1/attestations/kxco-verify@<version>`. A CycloneDX
|
|
317
|
+
SBOM is published, from v1.2.1, as a GitHub Release asset at
|
|
318
|
+
`releases/download/v<version>/sbom.cyclonedx.json`, a permanent unauthenticated
|
|
319
|
+
URL. The one runtime dependency, `@noble/post-quantum`, is pinned to an exact
|
|
320
|
+
version, and every GitHub Action is pinned by commit SHA.
|
|
291
321
|
|
|
292
|
-
|
|
293
|
-
|---|---|
|
|
294
|
-
| Sign and attest deployments | [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum) |
|
|
295
|
-
| Issue PQ-signed credentials | `kxco-pq-attest` |
|
|
296
|
-
| Agent-level signing and policy | `kxco-pq-agent` |
|
|
297
|
-
| **Verify any of the above** | **`kxco-verify`** (this package) |
|
|
298
|
-
| Public web verifier | [verify.kxco.ai](https://verify.kxco.ai) |
|
|
322
|
+
## Security
|
|
299
323
|
|
|
300
|
-
|
|
324
|
+
**ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.0, pinned exactly. No custom cryptography.
|
|
301
325
|
|
|
302
|
-
|
|
326
|
+
Evidenced, and reproducible on your own machine:
|
|
303
327
|
|
|
304
|
-
|
|
328
|
+
- **1,793 NIST ACVP vectors passed, 0 failed** across FIPS 203, 204 and 205 on `@noble/post-quantum` 0.7.0, pinned by digest, per [CONFORMANCE.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md). The other 310 are pairings the library refuses as weaker than the parameter set
|
|
329
|
+
- **225 interoperability checks passed, 0 failed**, against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py, in both directions
|
|
330
|
+
- **SLSA provenance** on every release since 1.2.1: verify with `npm audit signatures`
|
|
331
|
+
- **CycloneDX SBOM** published with every release since 1.2.1
|
|
305
332
|
|
|
306
|
-
|
|
333
|
+
The audit history of every upstream library is recorded in [AUDIT.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/AUDIT.md).
|
|
307
334
|
|
|
308
335
|
The library makes no outbound requests beyond the attestation URL you supply and the `pinAt` endpoint declared in the manifest. No data is sent to KXCO.
|
|
309
336
|
|
|
310
337
|
To report a vulnerability, open a [private security advisory](https://github.com/KnightsbridgeAIQ/kxco-verify/security/advisories/new) or email **john@knightsbridgelaw.com**. Acknowledgement within 2 business days, triage decision within 5. Full policy, including safe harbour for good-faith research: <https://kxco.ai/security>.
|
|
311
338
|
|
|
312
|
-
---
|
|
313
|
-
|
|
314
339
|
## License
|
|
315
340
|
|
|
316
|
-
Apache 2.0
|
|
317
|
-
|
|
318
|
-
---
|
|
341
|
+
Apache 2.0. See [LICENSE](./LICENSE).
|
|
319
342
|
|
|
320
343
|
## Maintainers
|
|
321
344
|
|
|
322
|
-
Shayne Heffernan and John Heffernan
|
|
345
|
+
Shayne Heffernan and John Heffernan, [KXCO by Knightsbridge](https://kxco.ai)
|
|
323
346
|
|
|
324
347
|
[knightsbridgelaw.com](https://knightsbridgelaw.com) · [target150.com](https://target150.com) · [livetradingnews.com](https://livetradingnews.com)
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-verify",
|
|
3
|
-
"version": "1.3.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "1.3.1",
|
|
4
|
+
"description": "Free, browser-safe verifier for KXCO ML-DSA-65 post-quantum signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live against the on-chain registry.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
7
7
|
"pqc",
|
|
@@ -15,11 +15,17 @@
|
|
|
15
15
|
"kxco-post-quantum",
|
|
16
16
|
"browser",
|
|
17
17
|
"browser-safe",
|
|
18
|
-
"zero-dependencies",
|
|
19
18
|
"supply-chain",
|
|
20
19
|
"deploy-attestation",
|
|
21
20
|
"provenance",
|
|
22
|
-
"manifest-verification"
|
|
21
|
+
"manifest-verification",
|
|
22
|
+
"pqc-migration",
|
|
23
|
+
"digital-signature",
|
|
24
|
+
"signature-verification",
|
|
25
|
+
"non-repudiation",
|
|
26
|
+
"tamper-evident",
|
|
27
|
+
"offline-verification",
|
|
28
|
+
"cli"
|
|
23
29
|
],
|
|
24
30
|
"license": "Apache-2.0",
|
|
25
31
|
"author": "Shayne Heffernan and John Heffernan",
|