proofbundle 1.2.0__tar.gz → 1.3.0__tar.gz

{proofbundle-1.2.0/src/proofbundle.egg-info → proofbundle-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.2.0
+Version: 1.3.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -18,6 +18,8 @@ Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security :: Cryptography
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
@@ -27,6 +29,8 @@ Provides-Extra: sdjwt
 Provides-Extra: eval
 Requires-Dist: rfc8785>=0.1.4; extra == "eval"
 Provides-Extra: adapters
+Provides-Extra: pq
+Requires-Dist: cryptography>=48; extra == "pq"
 Provides-Extra: pytest
 Requires-Dist: pytest>=7; extra == "pytest"
 Provides-Extra: inspect
@@ -53,9 +57,11 @@ Dynamic: license-file
 <h1>proofbundle</h1>
 
 **An offline verifier for AI eval receipts. Standards-native: Ed25519 signature,
-RFC 6962 transparency-log Merkle anchoring, optional SD-JWT (RFC 9901) selective
-disclosure, aligned to the in-toto test-result predicate. One portable JSON file,
-no server, no network.**
+RFC 6962 transparency-log Merkle anchoring, C2SP witnessed checkpoints and
+`.tlog-proof` transparent signatures (post-quantum-ready witnesses, ML-DSA-44),
+SD-JWT (RFC 9901) selective disclosure with Key Binding, Token-Status-List
+revocation snapshots, aligned to the in-toto test-result predicate. One portable
+file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
@@ -65,6 +71,9 @@ no server, no network.**
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+[![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
+[![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
+[![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
 <!-- DOI badge placeholder: enable Zenodo archiving for this repo, then add the Zenodo concept-DOI
      badge here (and the DOI to CITATION.cff) once Zenodo assigns one on the next release. No DOI has
      been assigned yet (no archived record exists at build time) — tracked in the human checklist. -->
@@ -73,11 +82,12 @@ no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 188 tests + a CI mutation gate.
 
 ## Contents
 
 - [Why](#why)
+- [What a receipt proves](#what-a-receipt-proves-and-what-it-does-not)
 - [What it verifies](#what-it-verifies)
 - [How it fits together](#how-it-fits-together)
 - [Install](#install)
@@ -88,6 +98,7 @@ checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
 - [Bundle format](#bundle-format-proofbundlev01)
 - [Eval receipts](#eval-receipts)
 - [Security notes and scope](#security-notes-and-scope-stated-honestly)
+- [Compliance](#compliance)
 - [Roadmap](#roadmap)
 - [Contributing](#contributing)
 - [License](#license)
@@ -214,7 +225,7 @@ proofbundle verify examples/example_bundle.json
 ```
 
 <div align="center">
-<img src="assets/demo.svg" alt="proofbundle verify output: four PASS checks and OK" width="680">
+<img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
 Machine-readable output and a non-zero exit code on failure:
@@ -312,6 +323,41 @@ both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
 witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
 
+Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
+0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
+optional `proofbundle[pq]` extra, Ed25519 stays the default) and the
+**[C2SP tlog-proof](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)** file
+format (`.tlog-proof`) — index + inclusion proof + (co)signed checkpoint in one
+portable, offline-verifiable "transparent signature":
+
+```bash
+proofbundle verify-proof receipt.tlog-proof --payload-file result.json \
+    --log-vkey <log-vkey> --witness-vkey <w1> --witness-vkey <w2> --threshold 2
+```
+
+Revocation joins the offline model too: a receipt SD-JWT can carry a Token
+Status List `status` claim, checked against a signed, **bundled list snapshot**
+(`proofbundle.statuslist`) — staleness is reported explicitly instead of
+assumed away.
+
+```mermaid
+flowchart LR
+    B["bundle.json<br/>(signed + anchored receipt)"] --> CK["tlog-checkpoint<br/>(signed note over the root)"]
+    CK --> W1["witness cosignature<br/>Ed25519 · 0x04"]
+    CK --> W2["witness cosignature<br/>ML-DSA-44 · 0x06 · PQ"]
+    B -->|"index + inclusion proof"| TP[".tlog-proof<br/>transparent signature"]
+    W1 --> TP
+    W2 --> TP
+    TP --> V{{"proofbundle verify-proof<br/>offline · k-of-n policy"}}
+    V --> R1["log signature"]
+    V --> R2["witness quorum"]
+    V --> R3["merkle inclusion"]
+
+    style V fill:#D6248A,stroke:#D6248A,color:#fff
+    style W2 fill:#1e2327,stroke:#D6248A,color:#fff
+    style TP fill:#1e2327,stroke:#D6248A,color:#fff
+```
+
 ## Bundle format (`proofbundle/v0.1`)
 
 The format is specified normatively in [SPEC.md](SPEC.md) (fields, encodings,
@@ -359,6 +405,11 @@ The scope is deliberately narrow. It does exactly what it says and no more:
 - Witness cosignatures (v1.2) prove consistency *observations* by the listed
   witnesses; real split-view resistance additionally requires the witnesses to be
   operationally independent — a deployment property no file format can supply.
+- Post-quantum: witness **cosignatures** may be ML-DSA-44 (v1.3, `[pq]` extra) — the layer where
+  the ecosystem (C2SP, Sigstore) is deploying PQ first. Primary signatures stay Ed25519 until the
+  ecosystem moves; a configured ML-DSA witness on a build without PQ support fails closed.
+- Revocation (v1.3) is checked against a SIGNED status-list snapshot the relying party supplies;
+  its freshness is reported and only judged against the caller's clock — never assumed.
 - The verifier does not fetch anything. Trust anchors (the signer key, the
   expected root, witness keys) are inputs you supply out of band.
 - No custom cryptography. Ed25519 comes from `cryptography`; Merkle hashing is
@@ -455,6 +506,16 @@ bundle-bound views.
 Every release ships **PEP 740 attestations** (Trusted Publishing) + an SLSA build-provenance
 attestation — see [SECURITY.md](SECURITY.md).
 
+## Compliance
+
+The EU AI Act's record-keeping duty for high-risk systems (Article 12 — automatic,
+tamper-evident, independently verifiable logs) applies from **August 2, 2026**;
+the GPAI Code of Practice expects documented, credible model evaluations.
+**[COMPLIANCE.md](COMPLIANCE.md)** maps — honestly, and without claiming more
+than the cryptography supports — what a verified receipt covers under Article 12,
+NIST AI RMF MEASURE, and the logging standards in flight (prEN 18229-1,
+ISO/IEC DIS 24970), including the anti-patterns no one should claim.
+
 ## Roadmap
 
 - **v0.1** — the offline verifier plus a real example bundle.
@@ -475,13 +536,19 @@ attestation — see [SECURITY.md](SECURITY.md).
   eval (end-of-task hook) or a pytest run (pytest11 plugin), plus a composite GitHub Action.
 - **v1.1** — trust hardening: a signed `assurance_level`, a THREAT_MODEL, a self_attested-
   without-prereg warning, model-swap + replay + withheld-field checks, and an adversarial No-Fake-PASS suite.
-- **v1.2 (current release)** — holder binding + witness quorum: **Key Binding JWT** verification
+- **v1.2** — holder binding + witness quorum: **Key Binding JWT** verification
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **Deferred** (explicitly not yet built) — SD-JWT VC conformance + `vct` metadata (not an RFC yet),
-  Token Status List verification (draft in the RFC-Editor queue; planned as a bundled snapshot to stay
-  offline), ML-DSA-44 cosignatures, an official in-toto PR, a full in-toto client.
+- **v1.3 (current release)** — the portable proof: **C2SP tlog-proof** emit/verify (+
+  `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
+  Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
+  `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
+  suite as a CI gate.
+- **Deferred** (explicitly not yet built) — full SD-JWT VC conformance + `vct` type-metadata
+  resolution (pre-IESG), per-sample Merkle receipts (the THREAT_MODEL's named gap; v2.0
+  direction), an official in-toto eval predicate (proposal path via OpenSSF/CoSAI), a full
+  in-toto client, a Python-3.10 floor.
 
 ## Contributing
 

{proofbundle-1.2.0 → proofbundle-1.3.0}/README.md

@@ -8,9 +8,11 @@
 <h1>proofbundle</h1>
 
 **An offline verifier for AI eval receipts. Standards-native: Ed25519 signature,
-RFC 6962 transparency-log Merkle anchoring, optional SD-JWT (RFC 9901) selective
-disclosure, aligned to the in-toto test-result predicate. One portable JSON file,
-no server, no network.**
+RFC 6962 transparency-log Merkle anchoring, C2SP witnessed checkpoints and
+`.tlog-proof` transparent signatures (post-quantum-ready witnesses, ML-DSA-44),
+SD-JWT (RFC 9901) selective disclosure with Key Binding, Token-Status-List
+revocation snapshots, aligned to the in-toto test-result predicate. One portable
+file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
@@ -20,6 +22,9 @@ no server, no network.**
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+[![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
+[![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
+[![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
 <!-- DOI badge placeholder: enable Zenodo archiving for this repo, then add the Zenodo concept-DOI
      badge here (and the DOI to CITATION.cff) once Zenodo assigns one on the next release. No DOI has
      been assigned yet (no archived record exists at build time) — tracked in the human checklist. -->
@@ -28,11 +33,12 @@ no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 188 tests + a CI mutation gate.
 
 ## Contents
 
 - [Why](#why)
+- [What a receipt proves](#what-a-receipt-proves-and-what-it-does-not)
 - [What it verifies](#what-it-verifies)
 - [How it fits together](#how-it-fits-together)
 - [Install](#install)
@@ -43,6 +49,7 @@ checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
 - [Bundle format](#bundle-format-proofbundlev01)
 - [Eval receipts](#eval-receipts)
 - [Security notes and scope](#security-notes-and-scope-stated-honestly)
+- [Compliance](#compliance)
 - [Roadmap](#roadmap)
 - [Contributing](#contributing)
 - [License](#license)
@@ -169,7 +176,7 @@ proofbundle verify examples/example_bundle.json
 ```
 
 <div align="center">
-<img src="assets/demo.svg" alt="proofbundle verify output: four PASS checks and OK" width="680">
+<img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
 Machine-readable output and a non-zero exit code on failure:
@@ -267,6 +274,41 @@ both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
 witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
 
+Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
+0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
+optional `proofbundle[pq]` extra, Ed25519 stays the default) and the
+**[C2SP tlog-proof](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)** file
+format (`.tlog-proof`) — index + inclusion proof + (co)signed checkpoint in one
+portable, offline-verifiable "transparent signature":
+
+```bash
+proofbundle verify-proof receipt.tlog-proof --payload-file result.json \
+    --log-vkey <log-vkey> --witness-vkey <w1> --witness-vkey <w2> --threshold 2
+```
+
+Revocation joins the offline model too: a receipt SD-JWT can carry a Token
+Status List `status` claim, checked against a signed, **bundled list snapshot**
+(`proofbundle.statuslist`) — staleness is reported explicitly instead of
+assumed away.
+
+```mermaid
+flowchart LR
+    B["bundle.json<br/>(signed + anchored receipt)"] --> CK["tlog-checkpoint<br/>(signed note over the root)"]
+    CK --> W1["witness cosignature<br/>Ed25519 · 0x04"]
+    CK --> W2["witness cosignature<br/>ML-DSA-44 · 0x06 · PQ"]
+    B -->|"index + inclusion proof"| TP[".tlog-proof<br/>transparent signature"]
+    W1 --> TP
+    W2 --> TP
+    TP --> V{{"proofbundle verify-proof<br/>offline · k-of-n policy"}}
+    V --> R1["log signature"]
+    V --> R2["witness quorum"]
+    V --> R3["merkle inclusion"]
+
+    style V fill:#D6248A,stroke:#D6248A,color:#fff
+    style W2 fill:#1e2327,stroke:#D6248A,color:#fff
+    style TP fill:#1e2327,stroke:#D6248A,color:#fff
+```
+
 ## Bundle format (`proofbundle/v0.1`)
 
 The format is specified normatively in [SPEC.md](SPEC.md) (fields, encodings,
@@ -314,6 +356,11 @@ The scope is deliberately narrow. It does exactly what it says and no more:
 - Witness cosignatures (v1.2) prove consistency *observations* by the listed
   witnesses; real split-view resistance additionally requires the witnesses to be
   operationally independent — a deployment property no file format can supply.
+- Post-quantum: witness **cosignatures** may be ML-DSA-44 (v1.3, `[pq]` extra) — the layer where
+  the ecosystem (C2SP, Sigstore) is deploying PQ first. Primary signatures stay Ed25519 until the
+  ecosystem moves; a configured ML-DSA witness on a build without PQ support fails closed.
+- Revocation (v1.3) is checked against a SIGNED status-list snapshot the relying party supplies;
+  its freshness is reported and only judged against the caller's clock — never assumed.
 - The verifier does not fetch anything. Trust anchors (the signer key, the
   expected root, witness keys) are inputs you supply out of band.
 - No custom cryptography. Ed25519 comes from `cryptography`; Merkle hashing is
@@ -410,6 +457,16 @@ bundle-bound views.
 Every release ships **PEP 740 attestations** (Trusted Publishing) + an SLSA build-provenance
 attestation — see [SECURITY.md](SECURITY.md).
 
+## Compliance
+
+The EU AI Act's record-keeping duty for high-risk systems (Article 12 — automatic,
+tamper-evident, independently verifiable logs) applies from **August 2, 2026**;
+the GPAI Code of Practice expects documented, credible model evaluations.
+**[COMPLIANCE.md](COMPLIANCE.md)** maps — honestly, and without claiming more
+than the cryptography supports — what a verified receipt covers under Article 12,
+NIST AI RMF MEASURE, and the logging standards in flight (prEN 18229-1,
+ISO/IEC DIS 24970), including the anti-patterns no one should claim.
+
 ## Roadmap
 
 - **v0.1** — the offline verifier plus a real example bundle.
@@ -430,13 +487,19 @@ attestation — see [SECURITY.md](SECURITY.md).
   eval (end-of-task hook) or a pytest run (pytest11 plugin), plus a composite GitHub Action.
 - **v1.1** — trust hardening: a signed `assurance_level`, a THREAT_MODEL, a self_attested-
   without-prereg warning, model-swap + replay + withheld-field checks, and an adversarial No-Fake-PASS suite.
-- **v1.2 (current release)** — holder binding + witness quorum: **Key Binding JWT** verification
+- **v1.2** — holder binding + witness quorum: **Key Binding JWT** verification
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **Deferred** (explicitly not yet built) — SD-JWT VC conformance + `vct` metadata (not an RFC yet),
-  Token Status List verification (draft in the RFC-Editor queue; planned as a bundled snapshot to stay
-  offline), ML-DSA-44 cosignatures, an official in-toto PR, a full in-toto client.
+- **v1.3 (current release)** — the portable proof: **C2SP tlog-proof** emit/verify (+
+  `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
+  Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
+  `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
+  suite as a CI gate.
+- **Deferred** (explicitly not yet built) — full SD-JWT VC conformance + `vct` type-metadata
+  resolution (pre-IESG), per-sample Merkle receipts (the THREAT_MODEL's named gap; v2.0
+  direction), an official in-toto eval predicate (proposal path via OpenSSF/CoSAI), a full
+  in-toto client, a Python-3.10 floor.
 
 ## Contributing
 

{proofbundle-1.2.0 → proofbundle-1.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.2.0"
+version = "1.3.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -30,6 +30,8 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Security :: Cryptography",
 ]
 dependencies = ["cryptography>=42"]
@@ -45,6 +47,10 @@ sdjwt = []
 eval = ["rfc8785>=0.1.4"]
 # The lm-eval adapter reads exported results.json (no import) → pure stdlib.
 adapters = []
+# ML-DSA-44 (FIPS 204) cosignature verification (C2SP tlog-cosignature type 0x06). Needs a
+# cryptography build with OpenSSL 3.5+ (default PyPI wheels since 48.0.0). Verify-only by default;
+# the emit helper needs the same. Ed25519 paths never require this.
+pq = ["cryptography>=48"]
 # The pytest plugin (opt-in test-run receipt via the pytest11 entry-point) — pytest is an optional extra,
 # never a core dependency. Floor 7.0: the hooks/stats API is signature-stable across pytest 7/8/9.
 pytest = ["pytest>=7"]

{proofbundle-1.2.0 → proofbundle-1.3.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.2.0"
+__version__ = "1.3.0"
 
 __all__ = [
     "__version__",
@@ -26,6 +26,10 @@ __all__ = [
     "verify_inclusion",
     "verify_consistency",
     "verify_key_binding",
+    "verify_tlog_proof",
+    "verify_cosignature",
+    "verify_witnessed_checkpoint",
+    "verify_status_snapshot",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -39,13 +43,20 @@ _LAZY = {
     "Check": ".errors", "ProofBundleError": ".errors", "VerificationResult": ".errors",
     "verify_consistency": ".merkle", "verify_inclusion": ".merkle",
     "verify_key_binding": ".kbjwt",
+    "verify_tlog_proof": ".tlogproof",
+    "verify_cosignature": ".checkpoint",
+    "verify_witnessed_checkpoint": ".checkpoint",
+    "verify_status_snapshot": ".statuslist",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
     from .bundle import SCHEMA, load_bundle, recompute_merkle_root_b64, verify_bundle
     from .emit import emit_bundle, generate_signer
     from .errors import Check, ProofBundleError, VerificationResult
+    from .checkpoint import verify_cosignature, verify_witnessed_checkpoint
     from .kbjwt import verify_key_binding
+    from .statuslist import verify_status_snapshot
+    from .tlogproof import verify_tlog_proof
     from .merkle import verify_consistency, verify_inclusion
 
 

{proofbundle-1.2.0 → proofbundle-1.3.0}/src/proofbundle/adapters/lm_eval.py

@@ -50,7 +50,9 @@ def from_lm_eval_results(path, task: str, metric: str, *, comparator: str, thres
     if value is None:
         raise ValueError(f"metric {metric!r} not found in results[{task!r}] "
                          f"(available: {sorted(k for k in res if ',' in k)})")
-    score = value if isinstance(value, str) else repr(value)
+    # Fixed-point format (never scientific notation, e.g. '1e-05') — build_eval_claim rejects scientific
+    # notation, so repr() silently dropped legitimate small scores (release-review fix, mirrors v0.8.1).
+    score = value if isinstance(value, str) else (format(float(value), ".12f").rstrip("0").rstrip(".") or "0")
 
     n_samples = data.get("n-samples", {}).get(task, {})
     n = int(n_samples.get("effective") or n_samples.get("original") or res.get("sample_len") or 0)

{proofbundle-1.2.0 → proofbundle-1.3.0}/src/proofbundle/bundle.py

@@ -96,8 +96,15 @@ def load_bundle(path: str) -> dict:
         return json.load(handle)
 
 
-def verify_bundle(bundle: Union[dict, str]) -> VerificationResult:
-    """Verify an evidence bundle (a dict or a path to a JSON file)."""
+def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce=None) -> VerificationResult:
+    """Verify an evidence bundle (a dict or a path to a JSON file).
+
+    ``expected_aud`` / ``expected_nonce`` (v1.3): when the bundle carries a Key Binding JWT, these enforce
+    RFC 9901 §7.3 replay/audience binding — the KB-JWT's ``aud`` MUST match ``expected_aud`` and its
+    ``nonce`` MUST match ``expected_nonce``. If omitted, the KB-JWT signature + disclosure binding are still
+    checked, but the relying party has NOT bound the presentation to itself/this transaction — a stale or
+    cross-audience replay would still verify. A relying party doing challenge-response MUST pass both.
+    """
     if isinstance(bundle, str):
         bundle = load_bundle(bundle)
     if not isinstance(bundle, dict):
@@ -148,6 +155,8 @@ def verify_bundle(bundle: Union[dict, str]) -> VerificationResult:
         sd = _require_dict(sd, "sd_jwt_vc")
         _reject_unknown(sd, _SD_KEYS, "sd_jwt_vc")
         compact = _require(sd, "compact", "sd_jwt_vc.compact")
+        if not isinstance(compact, str):   # malformed input → BundleFormatError, never a raw traceback
+            raise BundleFormatError("field sd_jwt_vc.compact must be a string")
         issuer_pub = None
         if sd.get("issuer_public_key_b64"):
             issuer_pub = _b64d(sd["issuer_public_key_b64"], "sd_jwt_vc.issuer_public_key_b64")
@@ -159,18 +168,21 @@ def verify_bundle(bundle: Union[dict, str]) -> VerificationResult:
                 sd_res["sig_ok"],
                 "issuer signature valid" if sd_res["sig_ok"] else "issuer signature invalid",
             )
-        # v1.2, fail-closed: a KB-JWT that is PRESENT must verify (RFC 9901 §4.3). Before
-        # v1.2 a trailing KB-JWT was silently ignored — a downgrade risk. Bundles without
-        # a KB-JWT are untouched ONLY when the issuer did NOT bind a holder key: a v0.9/v1.0/
-        # v1.1 bundle with no ``cnf`` verifies exactly as before.
-        # CRITICAL fix (release review 2026-07-02): if the issuer-signed payload DOES carry a
-        # ``cnf`` holder key (proof-of-possession REQUIRED by the issuer), a presentation with
-        # NO Key Binding JWT is a bearer downgrade — anyone who sees the disclosed SD-JWT could
-        # replay it. That MUST fail, not silently pass.
-        if isinstance(compact, str):
+        # v1.2/v1.3, fail-closed: a KB-JWT that is PRESENT must verify (RFC 9901 §4.3), AND if the issuer
+        # bound a `cnf` holder key (proof-of-possession REQUIRED) a presentation with NO KB-JWT is a bearer
+        # downgrade — anyone who sees the disclosed SD-JWT could replay it — so that MUST fail. expected_aud/
+        # expected_nonce (v1.3) enforce RFC 9901 §7.3 replay/audience binding when the relying party supplies
+        # them. Bundles issued without `cnf` and with no KB-JWT verify exactly as before (backward-compatible).
+        #
+        # The holder-binding check is only MEANINGFUL when the issuer signature was actually verified: the `cnf`
+        # holder key is declared INSIDE the issuer-signed JWT, so without a checked issuer signature an attacker
+        # could forge the whole SD-JWT (issuer JWT + cnf + matching KB-JWT). Only run it when the issuer
+        # public key was supplied AND its signature verified (release-review HIGH fix) — otherwise the SD-JWT is
+        # unauthenticated and no holder-binding claim over it can be trusted.
+        if sd_res.get("sig_checked") and sd_res.get("sig_ok"):
             sd_part, kb = split_key_binding(compact)
             if kb is not None:
-                kb_res = verify_key_binding(compact)
+                kb_res = verify_key_binding(compact, expected_aud=expected_aud, expected_nonce=expected_nonce)
                 result.add("sd-jwt-key-binding", kb_res["ok"], kb_res["detail"])
             elif _issuer_requires_holder_binding(sd_part):
                 result.add(
@@ -196,14 +208,20 @@ def recompute_merkle_root_b64(bundle: Union[dict, str]) -> dict:
         raise BundleFormatError("bundle must be a JSON object")
     payload = _b64d(_require(bundle, "payload_b64", "payload_b64"), "payload_b64")
     mk = _require_dict(_require(bundle, "merkle", "merkle"), "merkle")
+    # Validate hash_alg the same way verify_bundle does — recompute must not apply SHA-256/RFC-6962 primitives
+    # to a bundle that declares a different algorithm (audit LOW #11/#14).
+    hash_alg = mk.get("hash_alg", "sha256-rfc6962")
+    if hash_alg != "sha256-rfc6962":
+        raise UnsupportedError(f"merkle hash_alg {hash_alg!r} not supported in v0.1")
     leaf_index = _require_int(mk, "leaf_index", "merkle.leaf_index")
     tree_size = _require_int(mk, "tree_size", "merkle.tree_size")
     proof_list = _require(mk, "inclusion_proof_b64", "merkle.inclusion_proof_b64")
     if not isinstance(proof_list, list):
         raise BundleFormatError("field merkle.inclusion_proof_b64 must be a list")
     proof = [_b64d(p, "merkle.inclusion_proof_b64[]") for p in proof_list]
-    stated_b64 = _require(mk, "root_b64", "merkle.root_b64")
-    _b64d(stated_b64, "merkle.root_b64")   # validate encoding
+    # Display the stated root in CANONICAL base64 (re-encode from the decoded bytes), so a non-canonical but
+    # byte-equal stated root does not read as a spurious mismatch next to the canonical recomputed root (LOW #10/#15).
+    stated_b64 = base64.b64encode(_b64d(_require(mk, "root_b64", "merkle.root_b64"), "merkle.root_b64")).decode("ascii")
     try:
         recomputed = merkle.root_from_inclusion(
             leaf_index, tree_size, merkle.leaf_hash(payload), proof)