oept 0.1.1__py3-none-any.whl

oept/__init__.py

@@ -0,0 +1,32 @@
+"""OEPT public API.
+
+Intentionally tiny. Everything else is internal and may change.
+"""
+
+from __future__ import annotations
+
+from .bundle import BundleBuilder, build_bundle
+from .errors import (
+    ConfigurationError,
+    IntegrityError,
+    OeptError,
+    UnsupportedSpecError,
+    ValidationError,
+)
+from .models import VerificationResult
+from .verify import verify_bundle, verify_bundle_bytes
+
+__all__ = [
+    "BundleBuilder",
+    "ConfigurationError",
+    "IntegrityError",
+    "OeptError",
+    "UnsupportedSpecError",
+    "ValidationError",
+    "VerificationResult",
+    "build_bundle",
+    "verify_bundle",
+    "verify_bundle_bytes",
+]
+
+__version__ = "0.1.1"

oept/bundle.py

@@ -0,0 +1,175 @@
+"""Deterministic evidence-bundle builder (oept-bundle/0.1).
+
+A bundle is a deterministic ZIP with a canonical-JSON manifest. The manifest
+lists and hashes every member except itself. Determinism inputs: sorted
+member paths, fixed ZIP timestamps, fixed permission bits, DEFLATE
+compression, canonical JSON payloads.
+
+Reproducibility boundary (stated honestly): identical logical inputs
+produce identical manifest bytes on any platform. Complete-ZIP-byte
+identity additionally depends on the Python/zlib ZIP implementation and
+is asserted only for same-interpreter round-trips in the test suite.
+"""
+
+from __future__ import annotations
+
+import io
+import zipfile
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from .canonical import canonicalize_json
+from .errors import ValidationError
+from .hashing import sha256_bytes
+from .models import utc_now_iso
+
+BUNDLE_SPEC_VERSION = "oept-bundle/0.1"
+
+#: Fixed DOS timestamp used for every ZIP member (reproducibility).
+FIXED_ZIP_DATE_TIME = (2024, 1, 1, 0, 0, 0)
+
+#: Fixed unix permission bits for ZIP members (0o644 << 16).
+FIXED_EXTERNAL_ATTR = 0o644 << 16
+
+REQUIRED_MEMBERS = ("manifest.json", "facts.json", "provenance.json")
+
+EVIDENCE_PREFIX = "evidence/"
+
+
+@dataclass
+class BundleFile:
+    """One logical bundle member: archive path + exact bytes."""
+
+    path: str
+    data: bytes
+
+    @property
+    def sha256(self) -> str:
+        return sha256_bytes(self.data)
+
+
+def _check_member_path(path: str) -> None:
+    if not path or path.startswith("/") or "\\" in path or "\x00" in path:
+        raise ValidationError(f"unsafe bundle member path: {path!r}")
+    parts = path.split("/")
+    if any(part in ("", ".", "..") for part in parts):
+        raise ValidationError(f"unsafe bundle member path: {path!r}")
+    if len(path) > 512:
+        raise ValidationError(f"bundle member path too long: {path!r}")
+
+
+@dataclass
+class BundleBuilder:
+    """Accumulates members, then emits manifest + deterministic ZIP."""
+
+    bundle_id: str
+    created_at: str = ""
+    _files: dict[str, bytes] = field(default_factory=dict)
+    key_id: str | None = None
+
+    def __post_init__(self) -> None:
+        if not self.bundle_id or not self.bundle_id.strip():
+            raise ValidationError("bundle_id must be non-empty")
+        if not self.created_at:
+            self.created_at = utc_now_iso()
+
+    def add_file(self, path: str, data: bytes) -> BundleBuilder:
+        """Add one member. Duplicate paths are rejected (never overwritten)."""
+        _check_member_path(path)
+        if path in self._files:
+            raise ValidationError(f"duplicate bundle member path: {path!r}")
+        if path == "manifest.json":
+            raise ValidationError("manifest.json is generated by the builder")
+        if path == "signatures/manifest.sig":
+            raise ValidationError(
+                "signatures/manifest.sig is reserved for the signature; "
+                "pass signature= to build_zip_bytes instead"
+            )
+        self._files[path] = bytes(data)
+        return self
+
+    def add_evidence(self, name: str, data: bytes) -> BundleBuilder:
+        """Add raw evidence bytes under evidence/."""
+        return self.add_file(f"{EVIDENCE_PREFIX}{name}", data)
+
+    def manifest_dict(self) -> dict[str, Any]:
+        """Canonical manifest object (without signature members)."""
+        for required in ("facts.json", "provenance.json"):
+            if required not in self._files:
+                raise ValidationError(f"bundle is missing required member: {required}")
+        entries = [
+            {"path": path, "sha256": sha256_bytes(data), "size_bytes": len(data)}
+            for path, data in sorted(self._files.items())
+        ]
+        manifest: dict[str, Any] = {
+            "bundle_spec_version": BUNDLE_SPEC_VERSION,
+            "bundle_id": self.bundle_id,
+            "created_at": self.created_at,
+            "files": entries,
+        }
+        if self.key_id:
+            manifest["key_id"] = self.key_id
+        return manifest
+
+    def manifest_bytes(self) -> bytes:
+        """Canonical manifest bytes (the exact bytes that get signed)."""
+        return canonicalize_json(self.manifest_dict())
+
+    def _zip_members(self, signature: bytes | None = None) -> dict[str, bytes]:
+        members = dict(self._files)
+        if signature is not None:
+            if "signatures/manifest.sig" in members:
+                raise ValidationError("signatures/manifest.sig is reserved for the signature")
+            members["signatures/manifest.sig"] = signature
+        members["manifest.json"] = self.manifest_bytes()
+        return members
+
+    def build_zip_bytes(self, signature: bytes | None = None) -> bytes:
+        """Emit the deterministic ZIP.
+
+        Envelope rule (see spec/bundle-spec.md): signatures/manifest.sig is
+        written into the archive but is deliberately NOT listed in
+        manifest.json's file table, so signature verification never needs
+        the signature to check itself. signatures/key-info.json, when added
+        via add_file, IS listed and therefore bound to the signed payload
+        (its key_id stays identification-only; trust is caller-supplied).
+        """
+        members = self._zip_members(signature)
+        buffer = io.BytesIO()
+        with zipfile.ZipFile(buffer, "w", zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
+            for path in sorted(members):
+                info = zipfile.ZipInfo(path, date_time=FIXED_ZIP_DATE_TIME)
+                info.compress_type = zipfile.ZIP_DEFLATED
+                info.external_attr = FIXED_EXTERNAL_ATTR
+                info.create_system = 3
+                archive.writestr(info, members[path])
+        return buffer.getvalue()
+
+    def write_zip(self, output: str | Path, signature: bytes | None = None) -> Path:
+        """Write the deterministic ZIP to disk."""
+        target = Path(output)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(self.build_zip_bytes(signature))
+        return target
+
+
+def build_bundle(
+    files: Mapping[str, bytes],
+    bundle_id: str,
+    created_at: str = "",
+    signature: bytes | None = None,
+    key_id: str | None = None,
+) -> bytes:
+    """One-shot helper: members + id -> deterministic ZIP bytes."""
+    builder = BundleBuilder(bundle_id=bundle_id, created_at=created_at, key_id=key_id)
+    for path in sorted(files):
+        builder.add_file(path, files[path])
+    manifest = builder.manifest_dict()
+    if signature is not None and not manifest.get("key_id") and key_id is None:
+        raise ValidationError(
+            "signed bundles must carry a key_id label "
+            "(identification only; trust comes from caller-supplied keys)"
+        )
+    return builder.build_zip_bytes(signature)

oept/canonical.py

@@ -0,0 +1,85 @@
+"""Deterministic canonical JSON (RFC 8785 / JCS).
+
+OEPT does not implement its own canonicalizer. Canonical bytes are produced
+by the maintained ``jcs`` package (RFC 8785 JSON Canonicalization Scheme).
+If ``jcs`` cannot serialize a value, OEPT fails explicitly instead of
+falling back to an incompatible rendering.
+
+Supported value domain (the only domain OEPT schemas admit):
+  None, bool, int, str, list, tuple (as list), dict with str keys.
+
+Anything else — float (including NaN/Infinity), bytes, Decimal, datetime,
+set, custom objects — raises CanonicalizationError. Callers serialize
+Decimals as strings and datetimes as UTC ISO-8601 strings BEFORE calling
+into this module; that rule is enforced, not assumed.
+
+Known JCS limitation (failed explicitly, never silently): the ``jcs``
+library routes integers through binary64 floating point. Beyond 2**53,
+values round (9007199254740993 renders as ...992; 2**63-1 renders as
+...6000) and magnitudes >= 10**21 render in scientific notation, which
+RFC 8785 forbids for integers. OEPT therefore rejects integers outside
+±(2**53 - 1) outright — callers needing larger magnitudes must use
+decimal strings, exactly like Decimal values.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+import jcs
+
+from .errors import OeptError
+
+#: Largest integer magnitude serializable exactly. Every integer with
+#: |n| <= 2**53 - 1 is exactly representable in binary64, and the JCS
+#: backend renders this range in plain decimal notation. Anything larger
+#: is rejected (silent rounding or scientific notation). Enforced below,
+#: not assumed.
+_MAX_EXACT_JCS_INT = 2**53 - 1
+
+
+class CanonicalizationError(OeptError):
+    """A value outside the canonical domain was supplied."""
+
+
+def _check_domain(value: Any, path: str = "$") -> None:
+    if value is None or isinstance(value, (bool, str)):
+        return
+    if isinstance(value, int):
+        if abs(value) > _MAX_EXACT_JCS_INT:
+            raise CanonicalizationError(
+                f"{path}: integer magnitude exceeds the exactly "
+                "serializable JCS range (use a decimal string instead)"
+            )
+        return
+    if isinstance(value, float):
+        raise CanonicalizationError(
+            f"{path}: float is not in the canonical domain "
+            "(serialize Decimals as strings, reject NaN/Infinity)"
+        )
+    if isinstance(value, (list, tuple)):
+        for i, item in enumerate(value):
+            _check_domain(item, f"{path}[{i}]")
+        return
+    if isinstance(value, dict):
+        for key in value:
+            if not isinstance(key, str):
+                raise CanonicalizationError(f"{path}: non-string dict key {key!r} is not canonical")
+        for key, item in value.items():
+            _check_domain(item, f"{path}.{key}")
+        return
+    raise CanonicalizationError(
+        f"{path}: type {type(value).__name__} is not in the canonical domain"
+    )
+
+
+def canonicalize_json(value: Any) -> bytes:
+    """Return RFC 8785 canonical bytes (UTF-8) for a domain value."""
+    _check_domain(value)
+    try:
+        result = jcs.canonicalize(value)
+    except Exception as exc:
+        raise CanonicalizationError(f"JCS serialization failed: {exc}") from exc
+    if isinstance(result, str):
+        return result.encode("utf-8")
+    return bytes(result)

oept/cli.py

@@ -0,0 +1,228 @@
+"""OEPT command line interface.
+
+Commands:
+  oept bundle DIRECTORY --output BUNDLE   build a bundle from a directory
+  oept verify BUNDLE [--json] [--trust-keys FILE]
+  oept conformance [--dir DIR] [--json]   run the conformance corpus
+  oept schema (list | show NAME)          print JSON Schemas
+
+Exit codes: 0 verified/valid, 1 integrity failure, 2 usage/config error.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from collections.abc import Sequence
+from pathlib import Path
+
+from .bundle import BundleBuilder
+from .errors import ConfigurationError, OeptError, ValidationError
+from .models import VerificationResult
+from .signing import load_trust_keys, sign_manifest
+from .verify import verify_bundle
+
+FOOTER = "Technical verification only — not a legal, compliance, or factual conclusion."
+
+
+def _render_human(bundle_label: str, result: VerificationResult) -> str:
+    if result.status == "VALID_SIGNED":
+        signature = (
+            f"SIGNED (trusted key: {result.trusted_key_id})" if result.trusted_key_id else "SIGNED"
+        )
+    elif result.status == "VALID_UNSIGNED":
+        signature = "NOT PRESENT"
+    elif result.status == "SIGNATURE_KEY_UNKNOWN":
+        signature = "PRESENT (no trusted key supplied or matched)"
+    elif result.status in ("SIGNATURE_INVALID",):
+        signature = "INVALID"
+    else:
+        signature = "NOT EVALUATED"
+    lines = [
+        f"Bundle: {bundle_label}",
+        f"Specification: {result.bundle_spec_version or '-'}",
+        f"Structure: {'VALID' if result.status not in ('MALFORMED_BUNDLE', 'UNSAFE_ARCHIVE', 'UNSUPPORTED_SPEC_VERSION') else 'INVALID'}",
+        f"Member digests: {'VALID' if not result.mismatches and not result.missing else 'INVALID'}",
+        f"Signature: {signature}",
+        f"Result: {result.status}",
+    ]
+    for note in result.notes:
+        lines.append(f"Note: {note}")
+    if result.missing:
+        lines.append(f"Missing files: {len(result.missing)}")
+    if result.unexpected:
+        lines.append(f"Unexpected files: {len(result.unexpected)}")
+    if result.mismatches:
+        lines.append(f"Hash mismatches: {len(result.mismatches)}")
+    lines.append("")
+    lines.append(FOOTER)
+    return "\n".join(lines)
+
+
+def cmd_verify(args: argparse.Namespace) -> int:
+    try:
+        trusted = load_trust_keys(args.trust_keys) if args.trust_keys else []
+    except ConfigurationError as exc:
+        print(f"oept: error: {exc}", file=sys.stderr)
+        return 2
+    target = Path(args.bundle)
+    if not target.exists():
+        print(f"oept: error: bundle not found: {target}", file=sys.stderr)
+        return 2
+    try:
+        result = verify_bundle(target, trusted)
+    except OeptError as exc:
+        print(f"oept: error: {exc}", file=sys.stderr)
+        return 2
+    if args.json:
+        print(json.dumps(result.to_dict(), indent=2, sort_keys=True))
+    else:
+        print(_render_human(str(target), result))
+    return 0 if result.ok else 1
+
+
+def _iter_input_files(root: Path) -> dict[str, bytes]:
+    members: dict[str, bytes] = {}
+    for path in sorted(root.rglob("*")):
+        if path.is_dir():
+            continue
+        if path.is_symlink():
+            raise ValidationError(f"input contains symlink (refusing to bundle): {path}")
+        try:
+            name = path.relative_to(root).as_posix()
+        except ValueError as exc:
+            raise ValidationError(f"unresolvable input path: {path}") from exc
+        if name == "manifest.json" or name.startswith("signatures/"):
+            raise ValidationError(f"reserved bundle member in input directory: {name!r}")
+        members[name] = path.read_bytes()
+    if "facts.json" not in members or "provenance.json" not in members:
+        raise ValidationError("input directory must contain facts.json and provenance.json")
+    return members
+
+
+def cmd_bundle(args: argparse.Namespace) -> int:
+    if args.sign and not args.key_id:
+        print("oept: error: --sign requires --key-id", file=sys.stderr)
+        return 2
+    source = Path(args.directory)
+    if not source.is_dir():
+        print(f"oept: error: not a directory: {source}", file=sys.stderr)
+        return 2
+    try:
+        members = _iter_input_files(source)
+        builder = BundleBuilder(
+            bundle_id=args.bundle_id or source.name,
+            created_at=args.created_at or "",
+            key_id=args.key_id,
+        )
+        for path in sorted(members):
+            builder.add_file(path, members[path])
+        signature = None
+        if args.sign:
+            try:
+                private_key = Path(args.sign).read_bytes()
+            except OSError as exc:
+                print(f"oept: error: cannot read signing key: {exc}", file=sys.stderr)
+                return 2
+            try:
+                signature = sign_manifest(builder.manifest_bytes(), private_key)
+            except ConfigurationError as exc:
+                print(f"oept: error: {exc}", file=sys.stderr)
+                return 2
+        output = builder.write_zip(args.output, signature)
+    except (ValidationError, OeptError) as exc:
+        print(f"oept: error: {exc}", file=sys.stderr)
+        return 2
+    print(f"wrote {output} ({len(builder.manifest_dict()['files'])} members)")
+    return 0
+
+
+def cmd_conformance(args: argparse.Namespace) -> int:
+    from .conformance import run_conformance
+
+    root = Path(args.dir) if args.dir else None
+    try:
+        report = run_conformance(root)
+    except OeptError as exc:
+        print(f"oept: error: {exc}", file=sys.stderr)
+        return 2
+    if args.json:
+        print(json.dumps(report, indent=2, sort_keys=True))
+    else:
+        for name, status, expected, ok in report["cases"]:
+            mark = "ok" if ok else "MISMATCH"
+            print(f"{mark:8} {name:28} got={status} want={expected}")
+        print(f"{report['passed']}/{report['total']} conformance cases pass")
+    return 0 if report["failed"] == 0 else 1
+
+
+def cmd_schema(args: argparse.Namespace) -> int:
+    from .schemas import list_schemas, load_schema
+
+    if args.action == "list":
+        for name in list_schemas():
+            print(name)
+        return 0
+    try:
+        schema = load_schema(args.action)
+    except OeptError as exc:
+        print(f"oept: error: {exc}", file=sys.stderr)
+        return 2
+    print(json.dumps(schema, indent=2, sort_keys=True))
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="oept", description="Open Evidence Provenance Toolkit")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_verify = sub.add_parser("verify", help="verify a bundle offline")
+    p_verify.add_argument("bundle", help="bundle .zip file")
+    p_verify.add_argument("--json", action="store_true", help="machine-readable output")
+    p_verify.add_argument("--trust-keys", help="JSON trust-keys file for signatures")
+    p_verify.set_defaults(func=cmd_verify)
+
+    p_bundle = sub.add_parser("bundle", help="build a bundle from a directory")
+    p_bundle.add_argument("directory", help="evidence directory to package")
+    p_bundle.add_argument("--output", required=True, help="output .zip path")
+    p_bundle.add_argument(
+        "--bundle-id", default="", help="bundle identifier (default: directory name)"
+    )
+    p_bundle.add_argument("--created-at", default="", help="ISO-8601 timestamp (default: now, UTC)")
+    p_bundle.add_argument("--sign", default="", help="Ed25519 private key PEM file for signing")
+    p_bundle.add_argument(
+        "--key-id", default="", help="key identifier label (required with --sign)"
+    )
+    p_bundle.set_defaults(func=cmd_bundle)
+
+    p_conf = sub.add_parser("conformance", help="run the conformance corpus")
+    p_conf.add_argument(
+        "--dir", default="", help="conformance corpus directory (default: packaged corpus)"
+    )
+    p_conf.add_argument("--json", action="store_true", help="machine-readable output")
+    p_conf.set_defaults(func=cmd_conformance)
+
+    p_schema = sub.add_parser("schema", help="inspect JSON Schemas")
+    p_schema.add_argument("action", help="'list' or a schema name")
+    p_schema.set_defaults(func=cmd_schema)
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = build_parser()
+    try:
+        args = parser.parse_args(argv)
+    except SystemExit as exc:
+        return int(exc.code or 0)
+    try:
+        return int(args.func(args))
+    except BrokenPipeError:
+        return 1
+    except OeptError as exc:
+        print(f"oept: error: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

oept/conformance.py

@@ -0,0 +1,74 @@
+"""Conformance corpus runner.
+
+Each fixture directory under the corpus root contains a ``bundle.zip``
+(or ``bundle/`` directory) plus ``expected-result.json`` with at least a
+``status`` field. The runner verifies every fixture and compares the
+terminal status. Trust keys for signed fixtures live in the fixture
+directory (``trust-keys.json``) and are TEST ONLY material.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from .errors import OeptError
+from .signing import TrustedKey, load_trust_keys
+from .verify import verify_bundle, verify_bundle_dir
+
+
+def default_corpus_dir() -> Path:
+    """Packaged conformance corpus (installed data or repo checkout)."""
+    try:
+        from importlib import resources
+
+        anchor = resources.files("oept.data") / "conformance"
+        try:
+            if anchor.is_dir():
+                return Path(str(anchor))
+        except (OSError, ValueError):
+            pass
+    except (ImportError, ModuleNotFoundError, TypeError):
+        pass
+    here = Path(__file__).resolve().parent
+    candidates = [
+        here.parent.parent / "conformance" / "fixtures",
+        Path(__file__).resolve().parents[2] / "conformance" / "fixtures",
+    ]
+    for candidate in candidates:
+        if candidate.is_dir():
+            return candidate
+    raise OeptError("OEPT conformance corpus not found")
+
+
+def run_conformance(corpus_dir: Path | None = None) -> dict[str, Any]:
+    """Run every fixture. Returns {total, passed, failed, cases}."""
+    root = Path(corpus_dir) if corpus_dir else default_corpus_dir()
+    if not root.is_dir():
+        raise OeptError(f"conformance corpus is not a directory: {root}")
+    cases: list[tuple[str, str, str, bool]] = []
+    passed = 0
+    for fixture in sorted(p for p in root.iterdir() if p.is_dir()):
+        expected_path = fixture / "expected-result.json"
+        if not expected_path.exists():
+            raise OeptError(f"fixture {fixture.name} lacks expected-result.json")
+        expected = json.loads(expected_path.read_text(encoding="utf-8"))
+        want = expected.get("status")
+        trust_file = fixture / "trust-keys.json"
+        keys: list[TrustedKey] = []
+        if trust_file.exists():
+            keys = load_trust_keys(trust_file)
+        bundle_zip = fixture / "bundle.zip"
+        bundle_dir = fixture / "bundle"
+        if bundle_zip.exists():
+            got = verify_bundle(bundle_zip, keys).status
+        elif bundle_dir.is_dir():
+            got = verify_bundle_dir(bundle_dir, keys).status
+        else:
+            raise OeptError(f"fixture {fixture.name} has no bundle.zip/bundle/")
+        ok = got == want
+        passed += 1 if ok else 0
+        cases.append((fixture.name, got, str(want), ok))
+    total = len(cases)
+    return {"total": total, "passed": passed, "failed": total - passed, "cases": cases}

oept/data/__init__.py

@@ -0,0 +1 @@
+"""OEPT package data (schemas, conformance corpus)."""

oept/data/conformance/01-valid-unsigned/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "VALID_UNSIGNED"
+}

oept/data/conformance/02-valid-signed/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "VALID_SIGNED"
+}

oept/data/conformance/02-valid-signed/trust-keys.json

@@ -0,0 +1,6 @@
+[
+  {
+    "key_id": "conformance-test-key",
+    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAZHQFbcEU4SxGXn6EY0Xz6By9k70sQUa2DxU+mqfPgFc=\n-----END PUBLIC KEY-----\n"
+  }
+]

oept/data/conformance/03-tampered-artifact/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "HASH_MISMATCH"
+}

oept/data/conformance/04-missing-member/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "MISSING_FILE"
+}

oept/data/conformance/05-unsafe-path/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "UNSAFE_ARCHIVE"
+}

oept/data/conformance/06-signature-invalid/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "SIGNATURE_INVALID"
+}

oept/data/conformance/06-signature-invalid/trust-keys.json

@@ -0,0 +1,6 @@
+[
+  {
+    "key_id": "conformance-test-key",
+    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAZHQFbcEU4SxGXn6EY0Xz6By9k70sQUa2DxU+mqfPgFc=\n-----END PUBLIC KEY-----\n"
+  }
+]

oept/data/conformance/07-unknown-key/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "SIGNATURE_KEY_UNKNOWN"
+}

oept/data/conformance/08-unexpected-member/expected-result.json

@@ -0,0 +1,3 @@
+{
+  "status": "UNEXPECTED_FILE"
+}