proofbundle 3.2.0__tar.gz → 3.2.1__tar.gz

{proofbundle-3.2.0/src/proofbundle.egg-info → proofbundle-3.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.2.0
+Version: 3.2.1
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT

{proofbundle-3.2.0 → proofbundle-3.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.2.0"
+version = "3.2.1"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"

{proofbundle-3.2.0 → proofbundle-3.2.1}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.2.0"
+__version__ = "3.2.1"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump

{proofbundle-3.2.0 → proofbundle-3.2.1}/src/proofbundle/renewal.py

@@ -30,7 +30,7 @@ from dataclasses import dataclass, field
 from typing import Optional
 
 from .errors import Check, ProofBundleError, VerificationResult
-from .hashalg import HashAlgError, compute_digest, resolve_hash_alg
+from .hashalg import HASH_REGISTRY, HashAlgError, compute_digest, resolve_hash_alg
 from .pqsig import sign_mldsa, verify_hybrid, verify_mldsa
 from .signature import verify_ed25519
 
@@ -159,6 +159,13 @@ def _verify_ats_signature(ats: ArchiveTimeStamp, authority_keys: dict) -> bool:
     return False
 
 
+def _is_deprecated_hash(alg: str) -> bool:
+    """True iff ``alg`` is a KNOWN but deprecated registry hash (sha1/md5). An unknown/absent alg is not
+    'deprecated' (it fails the resolvable-hash check instead)."""
+    spec = HASH_REGISTRY.get(alg)
+    return spec is not None and spec.status == "deprecated"
+
+
 def _validate_digests(data_digests: Sequence[str]) -> None:
     """Fail closed unless every data digest is lowercase hex — this excludes the ``_SEP`` separator, so a
     single crafted string cannot masquerade as ``_SEP.join`` of several real digests (set/cardinality
@@ -276,7 +283,8 @@ def verify_sequence(sequence: list[list[ArchiveTimeStamp]], data_digests: Sequen
                     authority_keys: Optional[dict] = None,
                     anchor_verifier: Optional[Callable[[ArchiveTimeStamp], bool]] = None,
                     allow_unauthenticated_anchor: bool = False,
-                    require_pq: bool = False
+                    require_pq: bool = False,
+                    require_current_hash: bool = False
                     ) -> VerificationResult:
     """Verify an ArchiveTimeStampSequence end-to-end, walking the newest strong anchor back to the origin.
 
@@ -301,6 +309,17 @@ def verify_sequence(sequence: list[list[ArchiveTimeStamp]], data_digests: Sequen
         A PASS here means "structurally consistent", never "cryptographically anchored".
       * NONE of the above: fail closed — the newest-anchor check is FALSE with a clear message. This makes
         a naive ``verify_sequence(seq, data)`` refuse to certify an unauthenticated anchor (API-safety audit).
+
+    ``require_pq`` (PQ floor): the newest ATS's PQ signature must be VERIFIED, not merely labeled. A PQ leg
+    is only cryptographically checked in ``authority_keys`` mode (``_verify_ats_signature`` verifies the
+    hybrid/mldsa65 signature); in ``anchor_verifier`` / unauthenticated / no-anchor modes the ATS signature
+    is never checked, so a ``sig_alg`` label alone is not proof — ``require_pq`` fails closed there (No-Fake).
+
+    ``require_current_hash`` (hash-strength floor): by default a DEPRECATED newest hash is TOLERATED (a
+    hash-tree-renewed sequence must stay verifiable while its once-used hash ages; ``evaluate_renewal_policy``
+    is what flags a deprecated newest as renewal-overdue). A deprecated newest hash is always SURFACED as a
+    ``renewal:current_hash`` check so ``.ok`` alone never hides it; ``require_current_hash=True`` makes it a
+    hard fail-closed error for a relying party that wants one call to reject a weak-hash anchor.
     """
     result = VerificationResult()
 
@@ -418,10 +437,40 @@ def verify_sequence(sequence: list[list[ArchiveTimeStamp]], data_digests: Sequen
     #    hybrid), so a relying party that wants PQ protection is not satisfied by a (forgeable-after-quantum)
     #    ed25519-only anchor even while it still holds the ed25519 key for legacy validation.
     if require_pq:
-        pq_ok = "mldsa" in (newest.sig_alg or "")
-        result.checks.append(Check("renewal:pq_floor", pq_ok,
-                                   f"newest ATS sig_alg {newest.sig_alg!r} carries a PQ leg" if pq_ok
-                                   else f"newest ATS sig_alg {newest.sig_alg!r} has no PQ leg (require_pq)"))
+        # No-Fake: require_pq means the PQ leg was actually VERIFIED, not merely labeled. The mldsa leg is
+        # only cryptographically checked in authority-signature mode (_verify_ats_signature verifies the
+        # hybrid/mldsa65 signature over _ats_content); in anchor_verifier / unauthenticated / no-anchor modes
+        # the ATS signature is never checked, so a PQ label on newest.sig_alg proves nothing — fail closed.
+        pq_verified = anchored and anchor_mode == "authority signature" and "mldsa" in (newest.sig_alg or "")
+        if pq_verified:
+            pq_detail = (f"newest ATS carries a VERIFIED PQ leg (sig_alg {newest.sig_alg!r}, authority "
+                         "signature)")
+        elif anchor_mode != "authority signature":
+            pq_detail = (f"require_pq needs authority_keys to verify a PQ signature; anchor mode is "
+                         f"{anchor_mode!r} (a PQ label on sig_alg alone is not verification, fail-closed)")
+        else:
+            pq_detail = f"newest ATS sig_alg {newest.sig_alg!r} has no verified PQ leg (require_pq)"
+        result.checks.append(Check("renewal:pq_floor", pq_verified, pq_detail))
+
+    # hash-strength floor: a DEPRECATED newest hash is tolerated by default (historical-chain survival) but
+    # must never be hidden behind .ok — surface it as a check, and fail closed when require_current_hash.
+    # require_current_hash demands a KNOWN CURRENT hash: a deprecated OR unknown newest hash fails closed
+    # (an unknown hash also fails the resolvable-hash check above; here it is never mislabeled "current").
+    newest_dep = _is_deprecated_hash(newest.hash_alg)
+    _spec = HASH_REGISTRY.get(newest.hash_alg)
+    newest_current = _spec is not None and _spec.status == "current"
+    if newest_dep or require_current_hash:
+        hash_ok = newest_current if require_current_hash else True
+        if newest_dep:
+            hash_detail = (f"newest ATS hash {newest.hash_alg!r} is deprecated"
+                           + (" (require_current_hash, fail-closed)" if require_current_hash
+                              else " — .ok reflects structure, not hash strength; call evaluate_renewal_policy "
+                                   "or pass require_current_hash=True to reject"))
+        elif newest_current:
+            hash_detail = f"newest ATS hash {newest.hash_alg!r} is current"
+        else:
+            hash_detail = f"newest ATS hash {newest.hash_alg!r} is not a known current hash (require_current_hash)"
+        result.checks.append(Check("renewal:current_hash", hash_ok, hash_detail))
     return result
 
 
@@ -467,6 +516,12 @@ def evaluate_renewal_policy(sequence: list[list[ArchiveTimeStamp]], *, policy: R
     reasons = []
     if newest.hash_alg in policy.deprecated_algs:
         reasons.append(f"newest ATS uses policy-deprecated hash {newest.hash_alg!r}")
+    # Future-dated guard (No-Fake): a newest.time AFTER `now` is anomalous — the freshness/age test below
+    # ((now - newest.time) > max_ats_age) goes NEGATIVE for a future time and would report it as perpetually
+    # fresh, so a future date could otherwise permanently evade the renewal-due signal. Flag it as overdue.
+    _ints = all(isinstance(v, int) and not isinstance(v, bool) for v in (newest.time, now))
+    if _ints and newest.time > now:
+        reasons.append(f"newest ATS time {newest.time} is in the future (now={now}) — anomalous, not fresh")
     if policy.max_ats_age is not None and (now - newest.time) > policy.max_ats_age:
         reasons.append(f"newest ATS age {now - newest.time} exceeds max {policy.max_ats_age}")
 

{proofbundle-3.2.0 → proofbundle-3.2.1}/src/proofbundle/sdjwt.py

@@ -121,6 +121,7 @@ def verify_sd_jwt(compact: str, issuer_pubkey: Optional[bytes] = None) -> dict:
     _collect_committed_digests(payload, committed)
 
     all_committed = True
+    parsed_disclosures: list = []
     for d in disclosures:
         try:
             parsed = loads_strict(_b64url_decode(d))
@@ -136,9 +137,31 @@ def verify_sd_jwt(compact: str, issuer_pubkey: Optional[bytes] = None) -> dict:
         if not (isinstance(parsed, list) and len(parsed) in (2, 3)):
             all_committed = False
             break
-        if _digest(d, sd_alg) not in committed:
+        parsed_disclosures.append((d, parsed))
+
+    if all_committed:
+        # Recursive disclosures (RFC 9901): a disclosure's VALUE may itself carry ``_sd``/``...`` digests that
+        # commit to FURTHER disclosures. Resolve to a fixpoint — a disclosure is committed iff its digest is
+        # already in ``committed``; each newly-committed disclosure then contributes the ``_sd``/``...`` digests
+        # inside its own value (the last array element). Disclosure order is not guaranteed parent-first, hence
+        # the loop. Security is preserved: the fixpoint only ever GROWS ``committed`` from the issuer-signed
+        # payload outward, so a self-referential or otherwise unrooted disclosure never bootstraps itself. At the
+        # end EVERY disclosure must be committed (transitively rooted in the signed payload) — fail-closed.
+        pending = list(parsed_disclosures)
+        progressed = True
+        while progressed and pending:
+            progressed = False
+            still = []
+            for d, parsed in pending:
+                if _digest(d, sd_alg) in committed:
+                    _collect_committed_digests(parsed[-1], committed)
+                    progressed = True
+                else:
+                    still.append((d, parsed))
+            pending = still
+        if pending:  # a disclosure never became committed — uncommitted / not rooted in the signed payload
             all_committed = False
-            break
+
     result["structure_ok"] = all_committed and bool(parts[0])
 
     if issuer_pubkey is not None:

{proofbundle-3.2.0 → proofbundle-3.2.1}/src/proofbundle/trust_pack.py

@@ -55,13 +55,34 @@ def _is_int(v: Any) -> TypeGuard[int]:
     return isinstance(v, int) and not isinstance(v, bool)
 
 
+def _parse_rfc3339_z(s: str) -> datetime:
+    """Parse an RFC-3339 UTC 'Z' timestamp, tolerating optional fractional seconds of ANY length.
+
+    ``_RFC3339_Z`` accepts ``(\\.\\d+)?`` fractional seconds, but ``strptime`` with ``%S`` (no ``%f``) rejects
+    them, and ``%f`` itself caps at 6 digits — so an ``expires`` like ``...T00:00:00.5Z`` (regex-valid) would
+    raise and be read as EXPIRED (a false-closed availability bug). This parser splits off the fractional part
+    and truncates it to microseconds (enough for an expiry comparison). Raises ``ValueError`` on a non-match."""
+    m = re.match(r"^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$", s)
+    if not m:
+        raise ValueError(f"not an RFC-3339 UTC 'Z' timestamp: {s!r}")
+    dt = datetime.strptime(m.group(1), "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc)
+    frac = m.group(2)
+    if frac:
+        dt = dt.replace(microsecond=int((frac + "000000")[:6]))
+    return dt
+
+
 def validate_trust_pack_predicate(predicate: Any, *, strict: bool = False) -> list[str]:
     """Return fail-closed errors for a ``trust-pack/v0.1`` predicate (empty = valid).
 
     Beyond shape this enforces: threshold in 1..len(keyIds) per role; every keyId referenced by a role is
     present in ``keys``; ``revoked`` entries are known keyIds; a role's threshold is not already impossible
-    once revoked keys are removed (a pack whose root can never meet threshold is dead-on-arrival, fail-closed).
-    """
+    once revoked keys are removed (a pack whose root can never meet threshold is dead-on-arrival, fail-closed);
+    a ``version`` > 1 pack MUST carry a non-null ``prevVersionDigest`` (only version 1 may be a genesis).
+
+    ``strict`` currently adds no extra predicate-level required fields (the trust-pack predicate is small and
+    fully required by default); it is kept for signature parity with the emit/verify entry points, where it
+    additionally makes RFC-8785 canonicality fail-closed in ``verify_trust_pack`` (mirrors ``outcome.py``)."""
     errors: list[str] = []
     if not isinstance(predicate, dict):
         return ["predicate must be a JSON object"]
@@ -88,6 +109,13 @@ def validate_trust_pack_predicate(predicate: Any, *, strict: bool = False) -> li
     pv = predicate.get("prevVersionDigest")
     if "prevVersionDigest" in predicate and pv is not None and not _is_digest(pv):
         errors.append("prevVersionDigest must be a sha256 digest object or null")
+    # A version > 1 pack MUST chain to a predecessor (fail-closed, No-Fake): a "version-2 genesis" declaring
+    # prevVersionDigest=null evades two-stage rotation authorization entirely — verify_trust_pack only enters
+    # the rotation-vouch branch when prevVersionDigest is a digest, so a null predecessor on a v>=2 pack passes
+    # on its own self-signature. Only version 1 (the genuine genesis) may have a null prevVersionDigest.
+    if _is_int(ver) and ver >= 2 and pv is None:
+        errors.append("version > 1 requires a non-null prevVersionDigest (a version-N pack must chain to its "
+                      "predecessor; only version 1 may have a null prevVersionDigest)")
 
     keys = predicate.get("keys")
     key_ids: set[str] = set()
@@ -349,9 +377,9 @@ def verify_trust_pack(envelope: dict, *, strict: bool = False, now: datetime | N
     # Expiry.
     _now = now or datetime.now(timezone.utc)
     try:
-        exp = datetime.strptime(predicate["expires"], "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc)
+        exp = _parse_rfc3339_z(predicate["expires"])
         r["not_expired"] = exp > _now
-    except (ValueError, KeyError):
+    except (ValueError, KeyError, TypeError):
         r["not_expired"] = False
     if r["not_expired"] is False:
         r["errors"].append("trust pack is expired (expires <= now, fail-closed)")

{proofbundle-3.2.0 → proofbundle-3.2.1/src/proofbundle.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.2.0
+Version: 3.2.1
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT

{proofbundle-3.2.0 → proofbundle-3.2.1}/src/proofbundle.egg-info/SOURCES.txt

@@ -72,6 +72,7 @@ src/proofbundle/policies/strict-eval-template-v1.json
 src/proofbundle/policies/strict-prereg-template-v1.json
 tests/test_adapters.py
 tests/test_adversarial.py
+tests/test_anchor_hardening_321.py
 tests/test_anchor_longevity_property.py
 tests/test_anchor_target_trustedtime.py
 tests/test_anchors_chia.py
@@ -87,6 +88,7 @@ tests/test_bundle.py
 tests/test_bundle_robustness.py
 tests/test_canonical.py
 tests/test_checkpoint.py
+tests/test_checkpoint_external_vectors.py
 tests/test_checkpoint_quorum_property.py
 tests/test_claims_hygiene.py
 tests/test_cli.py
@@ -137,8 +139,10 @@ tests/test_lens_review_fixes_3_1_3.py
 tests/test_merkle.py
 tests/test_merkle_consistency_property.py
 tests/test_merkle_property.py
+tests/test_mldsa_acvp_vectors.py
 tests/test_official_vectors.py
 tests/test_ok_semantics.py
+tests/test_ots_external_vectors.py
 tests/test_outcome_verify.py
 tests/test_oversized_int_guard.py
 tests/test_persample.py
@@ -169,6 +173,7 @@ tests/test_sdjwt_issue.py
 tests/test_sdjwt_reference.py
 tests/test_sdjwt_vc.py
 tests/test_sdjwt_verify_binding.py
+tests/test_sdjwtvc_external_vectors.py
 tests/test_signature.py
 tests/test_statuslist.py
 tests/test_subject_binding.py

proofbundle-3.2.1/tests/test_anchor_hardening_321.py

@@ -0,0 +1,187 @@
+"""3.2.1 anchor-longevity hardening — the final-audit findings, each pinned RED->GREEN.
+
+Covers the defense-in-depth gaps a six-lens + red-team audit surfaced in the 3.2.0 anchor modules
+(all were non-default / incomplete-caller / weak-input cases, no forgery against a correct caller):
+
+* F1 ``require_pq`` was a LABEL check ("mldsa" in sig_alg) — it now requires the PQ signature to be
+  actually VERIFIED (only possible in authority_keys mode); a PQ label with an unverified anchor is not
+  proof and fails closed.
+* F2 ``evaluate_renewal_policy`` never flagged a FUTURE-dated newest ATS (age went negative -> perpetually
+  "fresh"); a future time is now anomalous and overdue.
+* R1 ``verify_sequence`` tolerated a deprecated newest hash with ``ok=True`` and no signal; it now surfaces
+  a ``renewal:current_hash`` check and, with ``require_current_hash=True``, fails closed.
+* F7 ``verify_sd_jwt`` collected committed digests only from the payload, so RFC-9901 RECURSIVE disclosures
+  (a digest committed inside a parent disclosure's value) failed valid vectors; a fixpoint now roots them.
+"""
+from __future__ import annotations
+
+import dataclasses
+import hashlib
+import unittest
+
+from proofbundle.renewal import (
+    ArchiveTimeStamp,
+    RenewalPolicy,
+    build_initial_sequence,
+    evaluate_renewal_policy,
+    verify_sequence,
+)
+from proofbundle.sdjwt import verify_sd_jwt
+from proofbundle.sdjwt_issue import _make_disclosure
+
+try:
+    from cryptography.hazmat.primitives.asymmetric import mldsa  # noqa: F401
+    _HAS_MLDSA = True
+except ImportError:
+    _HAS_MLDSA = False
+
+DATA = [hashlib.sha256(b"a").hexdigest(), hashlib.sha256(b"b").hexdigest()]
+
+
+def _check(result, name: str):
+    for c in result.checks:
+        if c.name == name:
+            return c
+    return None
+
+
+class TestRequirePqIsVerifiedNotLabeled(unittest.TestCase):
+    """F1: require_pq must reflect a VERIFIED PQ signature, not a sig_alg string."""
+
+    def test_pq_label_in_callback_mode_fails_closed(self):
+        # the exact label attack: a newest ATS LABELED mldsa65 but anchored via a caller callback (no ATS
+        # signature is ever verified). Old code: pq_ok = "mldsa" in "mldsa65" -> passed. Now: fail-closed.
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=1000)
+        faked = dataclasses.replace(seq[0][0], sig_alg="mldsa65")  # label only, empty signatures
+        r = verify_sequence([[faked]], DATA, anchor_verifier=lambda a: True, require_pq=True)
+        pq = _check(r, "renewal:pq_floor")
+        self.assertIsNotNone(pq)
+        self.assertFalse(pq.ok, pq)
+        self.assertFalse(r.ok)
+        self.assertIn("not verification", pq.detail)
+
+    def test_pq_label_in_unauthenticated_mode_fails_closed(self):
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=1000)
+        faked = dataclasses.replace(seq[0][0], sig_alg="mldsa65")
+        r = verify_sequence([[faked]], DATA, allow_unauthenticated_anchor=True, require_pq=True)
+        self.assertFalse(_check(r, "renewal:pq_floor").ok)
+
+    def test_ed25519_authority_has_no_pq_leg(self):
+        # a real ed25519 authority signature verifies the anchor, but carries no PQ leg -> require_pq fails.
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+        from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+        ed = Ed25519PrivateKey.generate()
+        pub = ed.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=1000,
+                                     sig_alg="ed25519", signers={"ed25519": ed})
+        r = verify_sequence(seq, DATA, authority_keys={"ed25519": pub}, require_pq=True)
+        self.assertTrue(_check(r, "renewal:last_anchor").ok)   # anchor itself IS verified
+        self.assertFalse(_check(r, "renewal:pq_floor").ok)     # but there is no PQ leg
+        self.assertFalse(r.ok)
+
+    @unittest.skipUnless(_HAS_MLDSA, "needs cryptography with FIPS 204 (ML-DSA)")
+    def test_verified_pq_authority_passes(self):
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+        from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+        from proofbundle.pqsig import generate_mldsa
+        ed = Ed25519PrivateKey.generate()
+        ed_pub = ed.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+        m = generate_mldsa("mldsa65")
+        m_pub = m.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=1000, sig_alg="mldsa65",
+                                     signers={"ed25519": ed, "mldsa65": m})
+        r = verify_sequence(seq, DATA, authority_keys={"ed25519": ed_pub, "mldsa65": m_pub},
+                            require_pq=True)
+        self.assertTrue(_check(r, "renewal:pq_floor").ok, r.as_dict())
+        self.assertTrue(r.ok, r.as_dict())
+
+
+class TestFutureDatedRenewalPolicy(unittest.TestCase):
+    """F2: a future-dated newest ATS is anomalous, not perpetually fresh."""
+
+    def test_future_time_is_overdue(self):
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=2000)
+        policy = RenewalPolicy(max_ats_age=1_000_000, strictness="fail")  # age alone would never trigger
+        r = evaluate_renewal_policy(seq, policy=policy, now=1000)  # newest.time 2000 is in the future
+        self.assertFalse(r.ok)
+        self.assertIn("future", _check(r, "renewal:policy").detail)
+
+    def test_present_time_still_passes(self):
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=900)
+        policy = RenewalPolicy(max_ats_age=1_000_000, strictness="fail")
+        r = evaluate_renewal_policy(seq, policy=policy, now=1000)
+        self.assertTrue(r.ok, r.as_dict())
+
+
+class TestRequireCurrentHash(unittest.TestCase):
+    """R1: a deprecated newest hash is surfaced, and fail-closed on demand."""
+
+    @staticmethod
+    def _sha1_seq():
+        covered = hashlib.sha1("\n".join(sorted(DATA)).encode()).hexdigest()  # noqa: S324 — historical chain
+        return [[ArchiveTimeStamp("sha1", covered, 1000)]]
+
+    def test_deprecated_newest_is_surfaced_but_tolerated_by_default(self):
+        r = verify_sequence(self._sha1_seq(), DATA, allow_unauthenticated_anchor=True)
+        ch = _check(r, "renewal:current_hash")
+        self.assertIsNotNone(ch)          # the signal is present (never hidden behind .ok)
+        self.assertTrue(ch.ok)            # tolerated by default (historical-chain survival)
+        self.assertIn("deprecated", ch.detail)
+        self.assertTrue(r.ok)             # structure verifies
+
+    def test_require_current_hash_fails_closed(self):
+        r = verify_sequence(self._sha1_seq(), DATA, allow_unauthenticated_anchor=True,
+                            require_current_hash=True)
+        self.assertFalse(_check(r, "renewal:current_hash").ok)
+        self.assertFalse(r.ok)
+
+    def test_current_newest_passes_require_current_hash(self):
+        seq = build_initial_sequence(DATA, hash_alg="sha256", time=1000)
+        r = verify_sequence(seq, DATA, allow_unauthenticated_anchor=True, require_current_hash=True)
+        self.assertTrue(_check(r, "renewal:current_hash").ok)
+        self.assertTrue(r.ok)
+
+
+class TestRecursiveDisclosures(unittest.TestCase):
+    """F7: RFC-9901 recursive disclosures (a digest committed inside a parent disclosure's value)."""
+
+    @staticmethod
+    def _jwt(payload_sd: list[str]) -> str:
+        import base64
+        import json
+
+        def b64(obj) -> str:
+            return base64.urlsafe_b64encode(json.dumps(obj).encode()).rstrip(b"=").decode("ascii")
+
+        header = b64({"alg": "EdDSA", "typ": "example+sd-jwt"})
+        payload = b64({"_sd": payload_sd, "_sd_alg": "sha-256"})
+        return f"{header}.{payload}.c2ln"  # sig irrelevant to structure_ok
+
+    def test_recursive_disclosure_verifies(self):
+        # child is selectively disclosable; the parent's VALUE is an object that commits to the child.
+        child_d, child_dig = _make_disclosure("secret", "child-value", "c2FsdC1jaGlsZA")
+        parent_d, parent_dig = _make_disclosure("parent", {"_sd": [child_dig]}, "c2FsdC1wYXJlbnQ")
+        compact = self._jwt([parent_dig]) + "~" + parent_d + "~" + child_d + "~"
+        r = verify_sd_jwt(compact)
+        self.assertTrue(r["structure_ok"], r)
+
+    def test_uncommitted_child_still_fails(self):
+        # the child's digest is committed NOWHERE (not in the payload, not in the parent's value) -> fail.
+        child_d, _child_dig = _make_disclosure("secret", "child-value", "c2FsdC1jaGlsZA")
+        parent_d, parent_dig = _make_disclosure("parent", {"plain": 1}, "c2FsdC1wYXJlbnQ")
+        compact = self._jwt([parent_dig]) + "~" + parent_d + "~" + child_d + "~"
+        r = verify_sd_jwt(compact)
+        self.assertFalse(r["structure_ok"])
+
+    def test_self_referential_disclosure_does_not_bootstrap(self):
+        # a disclosure whose value commits to its OWN digest, uncommitted by the payload, must not self-root.
+        # build the disclosure, read its digest, then reference it inside itself is impossible in one shot;
+        # instead: a disclosure committed nowhere stays uncommitted even though its value carries an _sd.
+        d, _dig = _make_disclosure("x", {"_sd": ["ZmFrZS1kaWdlc3Q"]}, "c2FsdC14")
+        compact = self._jwt([]) + "~" + d + "~"   # payload commits to nothing
+        r = verify_sd_jwt(compact)
+        self.assertFalse(r["structure_ok"])
+
+
+if __name__ == "__main__":
+    unittest.main()

proofbundle-3.2.1/tests/test_checkpoint_external_vectors.py

@@ -0,0 +1,163 @@
+"""proofbundle.checkpoint.verify_checkpoint against REAL C2SP tlog-checkpoint signed notes.
+
+These are not proofbundle-generated notes — they are frozen snapshots of the current signed note
+from two independent, currently-operating production transparency logs (see
+tests/fixtures/checkpoint/PROVENANCE.json):
+
+  * sum.golang.org — the Go module checksum database (`sumdb_latest.txt`).
+  * log2025-1.rekor.sigstore.dev — a Sigstore Rekor v2 transparency log (`rekor_v2_checkpoint.txt`).
+
+Neither test hand-types a "vkey" magic string. Each vkey is DERIVED here from independently
+sourced key material and its correctness is PROVEN by the fact that it makes
+`checkpoint.verify_checkpoint()` return `ok=True` against the real, live-fetched signed note:
+
+  * the sum.golang.org vkey is read out of the vendored `gosumdb_known_keys.go` (the Go
+    toolchain's OWN hardcoded trust anchor for that log, `knownGOSUMDB["sum.golang.org"]`) — used
+    directly, since a C2SP vkey string IS the canonical distribution format for this key.
+  * the log2025-1.rekor.sigstore.dev key is DECODED from the vendored `trusted_root.json`
+    (Sigstore's public trust root) — its DER SubjectPublicKeyInfo is parsed to raw Ed25519 bytes,
+    then run through `checkpoint.key_id()` / `checkpoint.vkey()` exactly as proofbundle's own
+    signer would. The resulting computed key ID must equal the checkpoint's own signature-line key
+    ID (`cf119915`).
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import re
+import unittest
+from pathlib import Path
+
+from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat, load_der_public_key
+
+from proofbundle import checkpoint as cp
+
+FIXTURE_DIR = Path(__file__).resolve().parent / "fixtures" / "checkpoint"
+PROVENANCE_PATH = FIXTURE_DIR / "PROVENANCE.json"
+
+_GOSUMDB_KEY_RE = re.compile(r'"sum\.golang\.org":\s*"([^"]+)"')
+
+
+def _load_provenance() -> dict:
+    return json.loads(PROVENANCE_PATH.read_text(encoding="utf-8"))
+
+
+def _sumdb_note() -> str:
+    return (FIXTURE_DIR / "sumdb_latest.txt").read_text(encoding="utf-8")
+
+
+def _sumdb_vkey() -> str:
+    src = (FIXTURE_DIR / "gosumdb_known_keys.go").read_text(encoding="utf-8")
+    m = _GOSUMDB_KEY_RE.search(src)
+    if not m:
+        raise AssertionError("could not find the sum.golang.org vkey in gosumdb_known_keys.go")
+    return m.group(1)
+
+
+def _rekor_note() -> str:
+    return (FIXTURE_DIR / "rekor_v2_checkpoint.txt").read_text(encoding="utf-8")
+
+
+def _rekor_vkey() -> tuple[str, bytes]:
+    """Derive the log2025-1.rekor.sigstore.dev C2SP vkey from the Sigstore trusted_root.json.
+    Returns (vkey, raw_pubkey)."""
+    root = json.loads((FIXTURE_DIR / "trusted_root.json").read_text(encoding="utf-8"))
+    tlog = next(t for t in root["tlogs"] if t["baseUrl"] == "https://log2025-1.rekor.sigstore.dev")
+    der = base64.b64decode(tlog["publicKey"]["rawBytes"])
+    pub = load_der_public_key(der)
+    raw = pub.public_bytes(Encoding.Raw, PublicFormat.Raw)
+    keyname = "log2025-1.rekor.sigstore.dev"
+    return cp.vkey(keyname, raw), raw
+
+
+@unittest.skipUnless(PROVENANCE_PATH.exists(), "checkpoint fixtures not vendored (tests/fixtures/checkpoint/)")
+class TestCheckpointFixtureIntegrity(unittest.TestCase):
+    def test_provenance_pins_every_vendored_file(self) -> None:
+        prov = _load_provenance()
+        entries = {e["filename"] for e in prov["files"]}
+        vendored = {p.name for p in FIXTURE_DIR.iterdir()
+                   if p.is_file() and p.name != "PROVENANCE.json"}
+        self.assertTrue(vendored)
+        self.assertEqual(vendored, entries,
+                         "every vendored file must have a PROVENANCE.json entry (and vice versa)")
+
+    def test_fixture_sha256_matches_provenance(self) -> None:
+        prov = _load_provenance()
+        for entry in prov["files"]:
+            actual = hashlib.sha256((FIXTURE_DIR / entry["filename"]).read_bytes()).hexdigest()
+            self.assertEqual(actual, entry["sha256"],
+                             f"{entry['filename']} does not match its PROVENANCE.json pin (tampered)")
+
+    def test_tampered_fixture_is_detected(self) -> None:
+        real = (FIXTURE_DIR / "sumdb_latest.txt").read_bytes()
+        tampered = bytearray(real)
+        tampered[0] ^= 0xFF
+        prov = _load_provenance()
+        pin = next(e["sha256"] for e in prov["files"] if e["filename"] == "sumdb_latest.txt")
+        self.assertNotEqual(hashlib.sha256(bytes(tampered)).hexdigest(), pin,
+                            "a single-byte tamper must change the SHA-256 (pin is not vacuous)")
+
+
+class TestGoSumdbCheckpointKat(unittest.TestCase):
+    def test_real_sumdb_note_verifies(self) -> None:
+        note = _sumdb_note()
+        res = cp.verify_checkpoint(note, _sumdb_vkey())
+        self.assertTrue(res["ok"], "sum.golang.org checkpoint failed to verify against its own "
+                                   "well-known public vkey (from the Go toolchain source)")
+        self.assertEqual(res["origin"], "go.sum database tree")
+        self.assertEqual(res["tree_size"], 57389448)
+
+    def test_root_tamper_is_rejected(self) -> None:
+        note = _sumdb_note()
+        vk = _sumdb_vkey()
+        lines = note.split("\n")
+        # line index 2 is the base64 root — flip it to an all-zero root of the same length
+        tampered_root_b64 = base64.b64encode(bytes(32)).decode("ascii")
+        self.assertNotEqual(lines[2], tampered_root_b64)
+        lines[2] = tampered_root_b64
+        self.assertFalse(cp.verify_checkpoint("\n".join(lines), vk)["ok"])
+
+    def test_foreign_key_rejected(self) -> None:
+        # a real, unrelated Ed25519 checkpoint key (proofbundle's own key generator) must not
+        # verify a note it never signed.
+        from proofbundle.emit import _raw_pub, generate_signer
+        note = _sumdb_note()
+        foreign_vkey = cp.vkey("sum.golang.org", _raw_pub(generate_signer()))
+        self.assertFalse(cp.verify_checkpoint(note, foreign_vkey)["ok"])
+
+
+class TestRekorV2CheckpointKat(unittest.TestCase):
+    def test_derived_vkey_key_id_matches_signature_line(self) -> None:
+        vk, raw_pub = _rekor_vkey()
+        kid = cp.key_id("log2025-1.rekor.sigstore.dev", raw_pub)
+        self.assertEqual(kid.hex(), "cf119915",
+                         "the C2SP key ID derived from the Sigstore trusted_root.json Ed25519 key "
+                         "must equal the well-known log2025-1 checkpoint key ID")
+
+    def test_real_rekor_v2_checkpoint_verifies(self) -> None:
+        vk, _ = _rekor_vkey()
+        res = cp.verify_checkpoint(_rekor_note(), vk)
+        self.assertTrue(res["ok"], "log2025-1.rekor.sigstore.dev checkpoint failed to verify "
+                                   "against the key derived from Sigstore's trusted_root.json")
+        self.assertEqual(res["origin"], "log2025-1.rekor.sigstore.dev")
+        self.assertEqual(res["tree_size"], 22578297)
+
+    def test_size_tamper_is_rejected(self) -> None:
+        vk, _ = _rekor_vkey()
+        note = _rekor_note()
+        lines = note.split("\n")
+        lines[1] = str(int(lines[1]) + 1)
+        self.assertFalse(cp.verify_checkpoint("\n".join(lines), vk)["ok"])
+
+    def test_sumdb_key_does_not_verify_rekor_checkpoint(self) -> None:
+        # cross-log negative: a real, valid vkey for a DIFFERENT log/keyname must not verify.
+        self.assertFalse(cp.verify_checkpoint(_rekor_note(), _sumdb_vkey())["ok"])
+
+    def test_rekor_key_does_not_verify_sumdb_note(self) -> None:
+        vk, _ = _rekor_vkey()
+        self.assertFalse(cp.verify_checkpoint(_sumdb_note(), vk)["ok"])
+
+
+if __name__ == "__main__":
+    unittest.main()