kxco-verify 1.3.1 → 1.3.3

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.3.3
+
+A manifest body that is valid JSON but not an object is refused with
+`invalid_input` by parseManifest, verifyManifest and verifyUrl, and `--file`
+exits 2 with the parse error. hexToBytes refuses characters that are not hex
+digits. verifyUrl reports a live key endpoint serving `null` as
+`live_pubkey_missing`, and a key that is not hex as the soft error
+`invalid_live_pubkey`.
+
+The README and the command line state exactly what a `"valid"` result covers:
+the manifest's `signedMessage`, which for KXCO manifests is the key identifier,
+commit and environment.
+
+## 1.3.2
+
+Documentation. No source change.
+
+A NOTICE file names the copyright owner, Knightsbridge Financial Ltd, trading
+as KXCO, and ships in the package, so anyone who redistributes it carries the
+attribution, as section 4(d) of the Apache License requires.
+
 ## 1.3.1
 
 Documentation. No source change.

package/NOTICE

@@ -0,0 +1,6 @@
+kxco-verify
+Copyright 2026 Knightsbridge Financial Ltd, trading as KXCO.
+Registered in England and Wales, company number 15684975.
+
+Licensed under the Apache License, Version 2.0. See LICENSE.
+https://kxco.ai

package/README.md

@@ -62,7 +62,7 @@ VALID  target150.com
   algorithm    ML-DSA-65
   kid          680f9af0bb44de3f
 
-This means the site signed its own manifest with a key it published.
+This means the key this manifest publishes signed its signedMessage.
 It is not an endorsement of the site, its owner, or its content.
 ```
 
@@ -126,12 +126,12 @@ const result = await verifyManifest(body)
 
 | `state` | Meaning |
 |---|---|
-| `"valid"` | Signature checks out against the manifest-declared key, and that key matches the live well-known endpoint. |
+| `"valid"` | Signature checks out against the manifest-declared key, and, where the manifest declares `pinAt`, that key matches the live well-known endpoint. |
 | `"rotated"` | Signature checks out, but the live well-known endpoint now serves a different key. The site is mid key-rotation: retry shortly. |
 | `"invalid"` | The signature does not verify under the manifest-declared key, or the key identifier is inconsistent with the published key bytes. |
 | `"error"` | The verifier could not run: network failure, malformed JSON, or unsupported algorithm. |
 
-A `"valid"` result is a precise cryptographic statement: the site signed this manifest with the key it publishes. Who operates the site is a separate question, covered in [`docs/threat-model.md`](./docs/threat-model.md).
+A `"valid"` result is a precise cryptographic statement: the key this manifest publishes signed its `signedMessage`, and where the manifest declares `pinAt`, `verifyUrl` found that key served there now. For KXCO's manifests `signedMessage` is `{kid}.{deployment.git_commit}.{deployment.env}`, so the key identifier, commit and environment are signed. `site`, `msgFormat` and the other `deployment` fields are read from the manifest as served. Who operates the site is a separate question, covered in [`docs/threat-model.md`](./docs/threat-model.md).
 
 ## For institutions
 
@@ -338,7 +338,7 @@ To report a vulnerability, open a [private security advisory](https://github.com
 
 ## License
 
-Apache 2.0. See [LICENSE](./LICENSE).
+Apache-2.0 © 2026 Knightsbridge Financial Ltd, trading as KXCO. See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).
 
 ## Maintainers
 

package/bin/kxco-verify.js

@@ -126,7 +126,7 @@ function render(result, live, opts) {
 
   // A valid result means one thing, and people read more into it than it says.
   if (result.state === 'valid') {
-    console.log(`\n${ANSI.dim}This means the site signed its own manifest with a key it published.`)
+    console.log(`\n${ANSI.dim}This means the key this manifest publishes signed its signedMessage.`)
     console.log(`It is not an endorsement of the site, its owner, or its content.${ANSI.reset}`)
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-verify",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Free, browser-safe verifier for KXCO ML-DSA-65 post-quantum signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live against the on-chain registry.",
   "keywords": [
     "post-quantum",
@@ -71,6 +71,7 @@
   "files": [
     "CHANGELOG.md",
     "LICENSE",
+    "NOTICE",
     "README.md",
     "bin",
     "src"
@@ -82,7 +83,7 @@
     "@noble/post-quantum": "0.7.0"
   },
   "scripts": {
-    "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
+    "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js test/property.test.js",
     "test:cov": "node --test --experimental-test-coverage test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js",
     "smoke": "node scripts/smoke.js",
     "lint": "node -c src/index.js && node -c src/parse.js && node -c src/verify.js && node -c src/fetch.js"
@@ -101,5 +102,9 @@
     "kxco-pq-network": {
       "optional": true
     }
+  },
+  "devDependencies": {
+    "fast-check": "4.10.2",
+    "kxco-post-quantum": "1.7.7"
   }
 }

package/src/index.js

@@ -5,9 +5,10 @@
 //   whether a site's post-quantum deploy attestation is mathematically valid.
 //
 // What it deliberately does NOT do:
-//   - Endorse any site. A "valid" result means "the site signed its own
-//     manifest with a key it published" — nothing about who the site is or
-//     whether its content is trustworthy.
+//   - Endorse any site. A "valid" result means "the key this manifest
+//     publishes signed its signedMessage" (for KXCO manifests, the kid, commit
+//     and environment), nothing about who the site is or whether its content
+//     is trustworthy.
 //   - Maintain a registry of approved (domain, kid) pairs. That is a future
 //     phase of kxco-post-quantum / verify.kxco.ai and not in this library.
 //   - Speak any algorithm other than ML-DSA-65 with hex encoding in this
@@ -174,7 +175,7 @@ export async function verifyUrl(attestationUrl, opts = {}) {
 
   // Two ways the publisher may serve the kid: explicit "kid" field, or we
   // recompute from the publicKey hex. Prefer recompute as the source of truth.
-  const livePubkeyHex = typeof liveJson.publicKey === 'string'
+  const livePubkeyHex = typeof liveJson?.publicKey === 'string'
     ? liveJson.publicKey
     : (typeof liveJson?.value === 'string' ? liveJson.value : null)
   if (!livePubkeyHex) {
@@ -183,7 +184,14 @@ export async function verifyUrl(attestationUrl, opts = {}) {
     result.verifiedAtMs = Date.now()
     return result
   }
-  const liveKid = await computeKid(livePubkeyHex)
+  let liveKid
+  try { liveKid = await computeKid(livePubkeyHex) }
+  catch (err) {
+    result.pubkeyUrl = pubkeyUrl
+    result.error = { kind: 'parse', code: 'invalid_live_pubkey', message: `live pubkey is not hex: ${err.message}`, soft: true }
+    result.verifiedAtMs = Date.now()
+    return result
+  }
   result.pubkeyUrl     = pubkeyUrl
   result.livePubkeyKid = liveKid
 

package/src/parse.js

@@ -60,6 +60,10 @@ export function parseManifest(input) {
   if (typeof input === 'string') {
     try { raw = JSON.parse(input) }
     catch (err) { return err_('invalid_json', `body is not valid JSON: ${err.message}`) }
+    // Valid JSON is not yet a manifest. `null`, a number, a string or a
+    // boolean has no fields to read, so it is refused here like any other
+    // input that is not an object.
+    if (!raw || typeof raw !== 'object') return err_('invalid_input', 'body must be a JSON object')
   } else if (input && typeof input === 'object') {
     raw = input
   } else {

package/src/verify.js

@@ -16,12 +16,12 @@ export function hexToBytes(hex) {
   if (typeof hex !== 'string' || hex.length % 2 !== 0) {
     throw new TypeError('hex input must be a string of even length')
   }
+  // Checked up front because parseInt reads a prefix: on its own it would take
+  // '0g' as 0, '+a' as 10 and '-1' as 255, giving one byte several spellings.
+  const bad = hex.search(/[^0-9a-fA-F]/)
+  if (bad !== -1) throw new TypeError(`malformed hex at offset ${bad}`)
   const out = new Uint8Array(hex.length / 2)
-  for (let i = 0; i < out.length; i++) {
-    const byte = parseInt(hex.substr(i * 2, 2), 16)
-    if (Number.isNaN(byte)) throw new TypeError(`malformed hex at offset ${i * 2}`)
-    out[i] = byte
-  }
+  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.substr(i * 2, 2), 16)
   return out
 }