provenance-protocol 0.2.1 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -5
- package/SPEC.md +74 -20
- package/package.json +5 -3
- package/schema/provenance-0.1.json +1 -1
- package/schema/provenance-0.2.json +229 -0
- package/src/canonical.js +98 -0
- package/src/cli.js +249 -151
- package/src/keygen.d.ts +15 -0
- package/src/keygen.js +22 -0
- package/src/verify.d.ts +10 -0
- package/src/verify.js +54 -8
- package/test-vectors/declarations-0.2.json +217 -0
|
@@ -0,0 +1,217 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$comment": "Normative test vectors for Provenance Protocol v0.2 declaration signatures. The signature covers the canonical form of the entire parsed declaration, excluding identity.signature itself.",
|
|
3
|
+
"spec_version": "0.2",
|
|
4
|
+
"algorithm": "ed25519",
|
|
5
|
+
"signing": {
|
|
6
|
+
"payload": "the string \"provenance-declaration-v1:\" followed by the canonical JSON of the parsed declaration with identity.signature removed",
|
|
7
|
+
"canonicalisation": "object keys sorted by code point recursively, no insignificant whitespace, applied to the PARSED value so formatting and key order do not matter"
|
|
8
|
+
},
|
|
9
|
+
"keypair": {
|
|
10
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
11
|
+
"private_key": "MC4CAQAwBQYDK2VwBCIEICnsl5v8baf3DyJApejP5DG3cmx1xS4S5qewS1A28IMN",
|
|
12
|
+
"$comment": "Test key only. Never use in production."
|
|
13
|
+
},
|
|
14
|
+
"reference_payload": "provenance-declaration-v1:{\"capabilities\":[\"read:web\",\"write:summaries\"],\"constraints\":[\"no:pii\",\"no:financial:transact\"],\"description\":\"A bounded fixture declaration for the signing vectors.\",\"identity\":{\"algorithm\":\"ed25519\",\"public_key\":\"MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=\"},\"name\":\"Fixture Research Agent\",\"provenance\":\"0.2\",\"provenance_id\":\"provenance:github:example/research-agent\",\"version\":\"1.2.0\"}",
|
|
15
|
+
"vectors": [
|
|
16
|
+
{
|
|
17
|
+
"id": "declaration-signature-valid",
|
|
18
|
+
"expect": "valid",
|
|
19
|
+
"purpose": "a correctly signed 0.2 declaration",
|
|
20
|
+
"declaration": {
|
|
21
|
+
"provenance": "0.2",
|
|
22
|
+
"name": "Fixture Research Agent",
|
|
23
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
24
|
+
"version": "1.2.0",
|
|
25
|
+
"capabilities": [
|
|
26
|
+
"read:web",
|
|
27
|
+
"write:summaries"
|
|
28
|
+
],
|
|
29
|
+
"constraints": [
|
|
30
|
+
"no:pii",
|
|
31
|
+
"no:financial:transact"
|
|
32
|
+
],
|
|
33
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
34
|
+
"identity": {
|
|
35
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
36
|
+
"algorithm": "ed25519",
|
|
37
|
+
"signature": "LqPe4bIXfa4qRhblNfp3VXElk2gG0x5UfTaHNKJGUDNbx4tRNXnJyXZZuu3BiC58Eur2JF719MieXU+EJe2pDg=="
|
|
38
|
+
}
|
|
39
|
+
}
|
|
40
|
+
},
|
|
41
|
+
{
|
|
42
|
+
"id": "declaration-key-order-irrelevant",
|
|
43
|
+
"expect": "valid",
|
|
44
|
+
"purpose": "the same declaration with keys in a different order must still verify",
|
|
45
|
+
"declaration": {
|
|
46
|
+
"identity": {
|
|
47
|
+
"signature": "LqPe4bIXfa4qRhblNfp3VXElk2gG0x5UfTaHNKJGUDNbx4tRNXnJyXZZuu3BiC58Eur2JF719MieXU+EJe2pDg==",
|
|
48
|
+
"algorithm": "ed25519",
|
|
49
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98="
|
|
50
|
+
},
|
|
51
|
+
"constraints": [
|
|
52
|
+
"no:pii",
|
|
53
|
+
"no:financial:transact"
|
|
54
|
+
],
|
|
55
|
+
"capabilities": [
|
|
56
|
+
"read:web",
|
|
57
|
+
"write:summaries"
|
|
58
|
+
],
|
|
59
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
60
|
+
"version": "1.2.0",
|
|
61
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
62
|
+
"name": "Fixture Research Agent",
|
|
63
|
+
"provenance": "0.2"
|
|
64
|
+
}
|
|
65
|
+
},
|
|
66
|
+
{
|
|
67
|
+
"id": "declaration-constraint-removed",
|
|
68
|
+
"expect": "invalid",
|
|
69
|
+
"purpose": "THE CASE 0.1 MISSED — deleting a declared constraint must break the signature",
|
|
70
|
+
"declaration": {
|
|
71
|
+
"provenance": "0.2",
|
|
72
|
+
"name": "Fixture Research Agent",
|
|
73
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
74
|
+
"version": "1.2.0",
|
|
75
|
+
"capabilities": [
|
|
76
|
+
"read:web",
|
|
77
|
+
"write:summaries"
|
|
78
|
+
],
|
|
79
|
+
"constraints": [
|
|
80
|
+
"no:pii"
|
|
81
|
+
],
|
|
82
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
83
|
+
"identity": {
|
|
84
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
85
|
+
"algorithm": "ed25519",
|
|
86
|
+
"signature": "LqPe4bIXfa4qRhblNfp3VXElk2gG0x5UfTaHNKJGUDNbx4tRNXnJyXZZuu3BiC58Eur2JF719MieXU+EJe2pDg=="
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
},
|
|
90
|
+
{
|
|
91
|
+
"id": "declaration-capability-added",
|
|
92
|
+
"expect": "invalid",
|
|
93
|
+
"purpose": "granting the agent a new declared power must break the signature",
|
|
94
|
+
"declaration": {
|
|
95
|
+
"provenance": "0.2",
|
|
96
|
+
"name": "Fixture Research Agent",
|
|
97
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
98
|
+
"version": "1.2.0",
|
|
99
|
+
"capabilities": [
|
|
100
|
+
"read:web",
|
|
101
|
+
"write:summaries",
|
|
102
|
+
"financial:transact"
|
|
103
|
+
],
|
|
104
|
+
"constraints": [
|
|
105
|
+
"no:pii",
|
|
106
|
+
"no:financial:transact"
|
|
107
|
+
],
|
|
108
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
109
|
+
"identity": {
|
|
110
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
111
|
+
"algorithm": "ed25519",
|
|
112
|
+
"signature": "LqPe4bIXfa4qRhblNfp3VXElk2gG0x5UfTaHNKJGUDNbx4tRNXnJyXZZuu3BiC58Eur2JF719MieXU+EJe2pDg=="
|
|
113
|
+
}
|
|
114
|
+
}
|
|
115
|
+
},
|
|
116
|
+
{
|
|
117
|
+
"id": "declaration-key-swapped",
|
|
118
|
+
"expect": "invalid",
|
|
119
|
+
"purpose": "substituting another public key must break the signature",
|
|
120
|
+
"declaration": {
|
|
121
|
+
"provenance": "0.2",
|
|
122
|
+
"name": "Fixture Research Agent",
|
|
123
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
124
|
+
"version": "1.2.0",
|
|
125
|
+
"capabilities": [
|
|
126
|
+
"read:web",
|
|
127
|
+
"write:summaries"
|
|
128
|
+
],
|
|
129
|
+
"constraints": [
|
|
130
|
+
"no:pii",
|
|
131
|
+
"no:financial:transact"
|
|
132
|
+
],
|
|
133
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
134
|
+
"identity": {
|
|
135
|
+
"public_key": "MCowBQYDK2VwAyEAiuHMTpGGFwJ8XGYRofeYY0s6rV1ywTl8nmLgHj08lew=",
|
|
136
|
+
"algorithm": "ed25519",
|
|
137
|
+
"signature": "LqPe4bIXfa4qRhblNfp3VXElk2gG0x5UfTaHNKJGUDNbx4tRNXnJyXZZuu3BiC58Eur2JF719MieXU+EJe2pDg=="
|
|
138
|
+
}
|
|
139
|
+
}
|
|
140
|
+
},
|
|
141
|
+
{
|
|
142
|
+
"id": "declaration-signed-with-wrong-key",
|
|
143
|
+
"expect": "invalid",
|
|
144
|
+
"purpose": "a signature made by a different private key must not verify",
|
|
145
|
+
"declaration": {
|
|
146
|
+
"provenance": "0.2",
|
|
147
|
+
"name": "Fixture Research Agent",
|
|
148
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
149
|
+
"version": "1.2.0",
|
|
150
|
+
"capabilities": [
|
|
151
|
+
"read:web",
|
|
152
|
+
"write:summaries"
|
|
153
|
+
],
|
|
154
|
+
"constraints": [
|
|
155
|
+
"no:pii",
|
|
156
|
+
"no:financial:transact"
|
|
157
|
+
],
|
|
158
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
159
|
+
"identity": {
|
|
160
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
161
|
+
"algorithm": "ed25519",
|
|
162
|
+
"signature": "SgK3ou1XNPOTQDP+gbwvbHPcs8+21SQaxChiHT14c5mHvZ3XzNH8secDlS/fDkog7iBN0oKQrw5O7RjLr61LCw=="
|
|
163
|
+
}
|
|
164
|
+
}
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "declaration-0.1-signature-in-0.2-file",
|
|
168
|
+
"expect": "invalid",
|
|
169
|
+
"purpose": "an old identity-only signature must not satisfy 0.2",
|
|
170
|
+
"declaration": {
|
|
171
|
+
"provenance": "0.2",
|
|
172
|
+
"name": "Fixture Research Agent",
|
|
173
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
174
|
+
"version": "1.2.0",
|
|
175
|
+
"capabilities": [
|
|
176
|
+
"read:web",
|
|
177
|
+
"write:summaries"
|
|
178
|
+
],
|
|
179
|
+
"constraints": [
|
|
180
|
+
"no:pii",
|
|
181
|
+
"no:financial:transact"
|
|
182
|
+
],
|
|
183
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
184
|
+
"identity": {
|
|
185
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
186
|
+
"algorithm": "ed25519",
|
|
187
|
+
"signature": "d4/wFYKJD8AQlKVDnC+JloeW7EnYUZ1pJoSG+HkM2wH/KMKYm8Dc6bdnCCNjtEIB/EiDei4+45DMdODPd9F0Cg=="
|
|
188
|
+
}
|
|
189
|
+
}
|
|
190
|
+
},
|
|
191
|
+
{
|
|
192
|
+
"id": "declaration-unknown-spec-version",
|
|
193
|
+
"expect": "invalid",
|
|
194
|
+
"purpose": "a verifier must refuse to guess the signing rule for a version it does not know",
|
|
195
|
+
"declaration": {
|
|
196
|
+
"provenance": "9.9",
|
|
197
|
+
"name": "Fixture Research Agent",
|
|
198
|
+
"description": "A bounded fixture declaration for the signing vectors.",
|
|
199
|
+
"version": "1.2.0",
|
|
200
|
+
"capabilities": [
|
|
201
|
+
"read:web",
|
|
202
|
+
"write:summaries"
|
|
203
|
+
],
|
|
204
|
+
"constraints": [
|
|
205
|
+
"no:pii",
|
|
206
|
+
"no:financial:transact"
|
|
207
|
+
],
|
|
208
|
+
"provenance_id": "provenance:github:example/research-agent",
|
|
209
|
+
"identity": {
|
|
210
|
+
"public_key": "MCowBQYDK2VwAyEAyuDQn/j1dbeAd288fU7lRV5cFcm7Zsm42jwCKy07N98=",
|
|
211
|
+
"algorithm": "ed25519",
|
|
212
|
+
"signature": "LqPe4bIXfa4qRhblNfp3VXElk2gG0x5UfTaHNKJGUDNbx4tRNXnJyXZZuu3BiC58Eur2JF719MieXU+EJe2pDg=="
|
|
213
|
+
}
|
|
214
|
+
}
|
|
215
|
+
}
|
|
216
|
+
]
|
|
217
|
+
}
|