proofbundle 0.4.0__tar.gz → 0.4.1__tar.gz

{proofbundle-0.4.0/src/proofbundle.egg-info → proofbundle-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 0.4.0
+Version: 0.4.1
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -61,7 +61,7 @@ selectively disclosable credential. Pure Python, no server, no daemon, one JSON
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 25 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 50 tests.
 
 ## Contents
 
@@ -241,12 +241,12 @@ string uses base64url as per the spec.
 
 ## Security notes and scope, stated honestly
 
-This is v0.1. It does exactly what it says and no more:
+The scope is deliberately narrow. It does exactly what it says and no more:
 
 - Ed25519 signatures only, for both the payload and the optional SD-JWT issuer
   signature.
 - SD-JWT: the SD-JWT core is now [RFC 9901](https://datatracker.ietf.org/doc/rfc9901/)
-  (Dec 2025); this verifies that every presented disclosure is committed in the
+  (November 2025); this verifies that every presented disclosure is committed in the
   issuer-signed payload, and the issuer signature (EdDSA) if a key is supplied. It
   does **not** verify a Key Binding JWT, an X.509 or trust-list chain, status
   lists, or `vct` type metadata. **SD-JWT VC** (the credential-type profile) is

{proofbundle-0.4.0 → proofbundle-0.4.1}/README.md

@@ -22,7 +22,7 @@ selectively disclosable credential. Pure Python, no server, no daemon, one JSON
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 25 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 50 tests.
 
 ## Contents
 
@@ -202,12 +202,12 @@ string uses base64url as per the spec.
 
 ## Security notes and scope, stated honestly
 
-This is v0.1. It does exactly what it says and no more:
+The scope is deliberately narrow. It does exactly what it says and no more:
 
 - Ed25519 signatures only, for both the payload and the optional SD-JWT issuer
   signature.
 - SD-JWT: the SD-JWT core is now [RFC 9901](https://datatracker.ietf.org/doc/rfc9901/)
-  (Dec 2025); this verifies that every presented disclosure is committed in the
+  (November 2025); this verifies that every presented disclosure is committed in the
   issuer-signed payload, and the issuer signature (EdDSA) if a key is supplied. It
   does **not** verify a Key Binding JWT, an X.509 or trust-list chain, status
   lists, or `vct` type metadata. **SD-JWT VC** (the credential-type profile) is

{proofbundle-0.4.0 → proofbundle-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "0.4.0"
+version = "0.4.1"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.9"

{proofbundle-0.4.0 → proofbundle-0.4.1}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from .emit import emit_bundle, generate_signer
 from .errors import Check, ProofBundleError, VerificationResult
 from .merkle import verify_consistency, verify_inclusion
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"
 
 __all__ = [
     "__version__",

{proofbundle-0.4.0 → proofbundle-0.4.1}/src/proofbundle/emit.py

@@ -5,9 +5,8 @@ Merkle tree, producing a bundle that ``verify_bundle`` accepts. This is the
 counterpart to the verifier: create the evidence here, check it anywhere with
 ``proofbundle verify``, fully offline.
 
-The v0.3 eval-receipt emitter (wrap one evaluation run into a signed,
-selectively disclosable receipt) is still a roadmap stub at the bottom of this
-module.
+The eval-receipt emitter that builds on this (``emit_eval_receipt``) lives in
+:mod:`proofbundle.evalclaim` since v0.4.
 """
 
 from __future__ import annotations
@@ -110,29 +109,3 @@ def emit_bundle(
     if sd_jwt_vc is not None:
         bundle["sd_jwt_vc"] = sd_jwt_vc
     return bundle
-
-
-# --------------------------------------------------------------------------
-# Roadmap stub, v0.3
-# --------------------------------------------------------------------------
-
-
-class NotYetImplemented(NotImplementedError):
-    """Raised by roadmap functions that are planned but not implemented yet."""
-
-
-def emit_eval_receipt(*args, **kwargs):  # pragma: no cover - roadmap stub
-    """v0.3, the core differentiator.
-
-    Wrap one evaluation framework run (Inspect AI, lm-evaluation-harness) into a
-    signed receipt whose payload is a minimal, RFC 8785 canonicalized claim such
-    as ``{"suite": "...", "threshold": 0.8, "passed": true}``, optionally wrapped
-    as an SD-JWT VC so a holder can disclose "passed above threshold" without
-    revealing the model, weights or dataset, carrying a cluster-bootstrap
-    confidence interval, a multiple-testing correction and a preregistration
-    hash. Built on top of :func:`emit_bundle`.
-    """
-    raise NotYetImplemented(
-        "emit_eval_receipt lands in v0.3. Use emit_bundle for a generic signed, "
-        "anchored bundle today."
-    )

{proofbundle-0.4.0 → proofbundle-0.4.1}/src/proofbundle/sdjwt.py

@@ -1,6 +1,6 @@
 """Minimal SD-JWT selective disclosure verification.
 
-The SD-JWT *core* is now a published standard, RFC 9901 (December 2025). This
+The SD-JWT *core* is now a published standard, RFC 9901 (November 2025). This
 module verifies the heart of it: that every presented Disclosure hashes to a
 digest that is actually committed in the issuer-signed JWT payload, and, if an
 issuer public key is supplied and the algorithm is EdDSA, that the issuer

{proofbundle-0.4.0 → proofbundle-0.4.1/src/proofbundle.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 0.4.0
+Version: 0.4.1
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -61,7 +61,7 @@ selectively disclosable credential. Pure Python, no server, no daemon, one JSON
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 25 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 50 tests.
 
 ## Contents
 
@@ -241,12 +241,12 @@ string uses base64url as per the spec.
 
 ## Security notes and scope, stated honestly
 
-This is v0.1. It does exactly what it says and no more:
+The scope is deliberately narrow. It does exactly what it says and no more:
 
 - Ed25519 signatures only, for both the payload and the optional SD-JWT issuer
   signature.
 - SD-JWT: the SD-JWT core is now [RFC 9901](https://datatracker.ietf.org/doc/rfc9901/)
-  (Dec 2025); this verifies that every presented disclosure is committed in the
+  (November 2025); this verifies that every presented disclosure is committed in the
   issuer-signed payload, and the issuer signature (EdDSA) if a key is supplied. It
   does **not** verify a Key Binding JWT, an X.509 or trust-list chain, status
   lists, or `vct` type metadata. **SD-JWT VC** (the credential-type profile) is