touchstone-verify 0.3.2__tar.gz

touchstone_verify-0.3.2/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

touchstone_verify-0.3.2/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: touchstone-verify
+Version: 0.3.2
+Summary: Independently verify a Touchstone disclosure — zero dependencies, pure Python.
+Author: Touchstone
+License: Apache-2.0
+Project-URL: Homepage, https://touchstone.cv
+Project-URL: Source, https://github.com/Touchstone-CV/touchstone-verify
+Keywords: touchstone,audit-log,verifier,ed25519,tamper-evident,provenance
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# touchstone-verify
+
+Independently verify a **[Touchstone](https://touchstone.cv)** disclosure — in pure Python,
+with **zero dependencies**. Read it before you trust it: it's a small, self-contained file.
+
+A disclosure is a tamper-evident slice of an agent's action log. This package re-derives,
+with no trust in Touchstone, that the slice is **intact** (entry hashes recompute), **attributed**
+(the subject's Ed25519 signature holds, epoch-aware across key rotation), and **ordered**
+(hash-chained, with checkpoints that are append-only, server-signed, and witness-co-signed). It
+also checks **selective-disclosure** field proofs and reports the external anchors. It proves
+tampering by anyone who is not Touchstone — it does **not** prove completeness, and says so.
+
+It agrees byte-for-byte with the other two Touchstone verifiers (`verify.php`, `verifier.js`):
+all three are tested against the same conformance corpus.
+
+## Install
+
+```bash
+pip install touchstone-verify
+```
+
+## Use
+
+Command line — pass a file, a URL, or a disclosure token:
+
+```bash
+touchstone-verify https://touchstone.cv/d/833cd4ca23fbb940dd71843ca47a807e
+touchstone-verify ./bundle.json
+touchstone-verify 833cd4ca23fbb940dd71843ca47a807e        # fetches from touchstone.cv
+```
+
+Exit code `0` = verified, `1` = a load-bearing check failed, `2` = couldn't load.
+
+Library:
+
+```python
+from touchstone_verify import verify_disclosure
+import json, urllib.request
+
+bundle = json.load(urllib.request.urlopen("https://touchstone.cv/d/<token>"))
+result = verify_disclosure(bundle)
+print(result["ok"])           # True / False
+for e in result["entries"]:
+    for c in e["checks"]:
+        print(c["ok"], c["msg"])
+```
+
+## What it checks
+
+- **Integrity** — every `entry_hash` recomputes from its fields.
+- **Attribution** — the subject signature verifies over the canonical signed content; genesis
+  proof-of-possession; `key_rotation` new-key PoP; counterparty co-signatures.
+- **Ordering** — `prev_hash` chain linkage; Merkle inclusion in the cited checkpoint.
+- **Checkpoints** — server signature over each Merkle root; append-only linkage between
+  consecutive checkpoints; independent witness co-signatures.
+- **Selective disclosure** — each revealed field proves Merkle inclusion in `payload_hash`;
+  withheld fields never appear in the bundle.
+
+For split-view / Bitcoin-anchor cross-checking across independent relays, see the companion
+`gossip_check.py` at <https://touchstone.cv/gossip_check.py>.
+
+## License
+
+[Apache-2.0](./LICENSE).

touchstone_verify-0.3.2/README.md

@@ -0,0 +1,64 @@
+# touchstone-verify
+
+Independently verify a **[Touchstone](https://touchstone.cv)** disclosure — in pure Python,
+with **zero dependencies**. Read it before you trust it: it's a small, self-contained file.
+
+A disclosure is a tamper-evident slice of an agent's action log. This package re-derives,
+with no trust in Touchstone, that the slice is **intact** (entry hashes recompute), **attributed**
+(the subject's Ed25519 signature holds, epoch-aware across key rotation), and **ordered**
+(hash-chained, with checkpoints that are append-only, server-signed, and witness-co-signed). It
+also checks **selective-disclosure** field proofs and reports the external anchors. It proves
+tampering by anyone who is not Touchstone — it does **not** prove completeness, and says so.
+
+It agrees byte-for-byte with the other two Touchstone verifiers (`verify.php`, `verifier.js`):
+all three are tested against the same conformance corpus.
+
+## Install
+
+```bash
+pip install touchstone-verify
+```
+
+## Use
+
+Command line — pass a file, a URL, or a disclosure token:
+
+```bash
+touchstone-verify https://touchstone.cv/d/833cd4ca23fbb940dd71843ca47a807e
+touchstone-verify ./bundle.json
+touchstone-verify 833cd4ca23fbb940dd71843ca47a807e        # fetches from touchstone.cv
+```
+
+Exit code `0` = verified, `1` = a load-bearing check failed, `2` = couldn't load.
+
+Library:
+
+```python
+from touchstone_verify import verify_disclosure
+import json, urllib.request
+
+bundle = json.load(urllib.request.urlopen("https://touchstone.cv/d/<token>"))
+result = verify_disclosure(bundle)
+print(result["ok"])           # True / False
+for e in result["entries"]:
+    for c in e["checks"]:
+        print(c["ok"], c["msg"])
+```
+
+## What it checks
+
+- **Integrity** — every `entry_hash` recomputes from its fields.
+- **Attribution** — the subject signature verifies over the canonical signed content; genesis
+  proof-of-possession; `key_rotation` new-key PoP; counterparty co-signatures.
+- **Ordering** — `prev_hash` chain linkage; Merkle inclusion in the cited checkpoint.
+- **Checkpoints** — server signature over each Merkle root; append-only linkage between
+  consecutive checkpoints; independent witness co-signatures.
+- **Selective disclosure** — each revealed field proves Merkle inclusion in `payload_hash`;
+  withheld fields never appear in the bundle.
+
+For split-view / Bitcoin-anchor cross-checking across independent relays, see the companion
+`gossip_check.py` at <https://touchstone.cv/gossip_check.py>.
+
+## License
+
+[Apache-2.0](./LICENSE).

touchstone_verify-0.3.2/pyproject.toml

@@ -0,0 +1,28 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "touchstone-verify"
+version = "0.3.2"
+description = "Independently verify a Touchstone disclosure — zero dependencies, pure Python."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Touchstone" }]
+keywords = ["touchstone", "audit-log", "verifier", "ed25519", "tamper-evident", "provenance"]
+classifiers = [
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security :: Cryptography",
+]
+
+[project.urls]
+Homepage = "https://touchstone.cv"
+Source = "https://github.com/Touchstone-CV/touchstone-verify"
+
+[project.scripts]
+touchstone-verify = "touchstone_verify.__main__:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

touchstone_verify-0.3.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

touchstone_verify-0.3.2/src/touchstone_verify/__init__.py

@@ -0,0 +1,9 @@
+"""touchstone-verify — independently verify a Touchstone disclosure, zero dependencies.
+
+    from touchstone_verify import verify_disclosure
+    result = verify_disclosure(bundle_dict)   # {"ok": True/False, "entries": [...], ...}
+"""
+from .verify import jcs, verify_disclosure
+
+__all__ = ["verify_disclosure", "jcs"]
+__version__ = "0.3.2"

touchstone_verify-0.3.2/src/touchstone_verify/__main__.py

@@ -0,0 +1,74 @@
+"""CLI:  python -m touchstone_verify <disclosure.json | /d/<token> | <token> | URL>
+
+Reads a bundle from a file, a https URL, or a Touchstone disclosure token (fetched
+from --base, default https://touchstone.cv), verifies it, and prints PASS/FAIL.
+Exit 0 = verified, 1 = failed, 2 = could not load.
+"""
+import json
+import re
+import sys
+import urllib.request
+
+from .verify import verify_disclosure
+
+GREEN, RED, DIM, RST = "\033[32m", "\033[31m", "\033[2m", "\033[0m"
+
+
+def _load(arg: str, base: str) -> dict:
+    if arg.startswith("http://") or arg.startswith("https://"):
+        with urllib.request.urlopen(arg, timeout=15) as r:
+            return json.load(r)
+    try:
+        with open(arg, encoding="utf-8") as fh:
+            return json.load(fh)
+    except (FileNotFoundError, OSError):
+        token = arg.rsplit("/", 1)[-1]
+        if not re.match(r"^[0-9a-f]{8,64}$", token):
+            raise SystemExit(f"not a file, URL, or disclosure token: {arg}")
+        with urllib.request.urlopen(f"{base}/d/{token}", timeout=15) as r:
+            return json.load(r)
+
+
+def main(argv=None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    base = "https://touchstone.cv"
+    if "--base" in argv:
+        i = argv.index("--base")
+        base = argv[i + 1].rstrip("/")
+        del argv[i:i + 2]
+    if not argv:
+        print("usage: python -m touchstone_verify <file|url|token> [--base URL]", file=sys.stderr)
+        return 2
+
+    try:
+        bundle = _load(argv[0], base)
+    except Exception as e:  # noqa: BLE001
+        print(f"could not load: {e}", file=sys.stderr)
+        return 2
+
+    res = verify_disclosure(bundle)
+    if not res.get("format_ok"):
+        print(f"{RED}NOT A DISCLOSURE{RST}: {res.get('error')}")
+        return 2
+
+    print(f"recorder {res['recorder']}  subject {res.get('subject')}  tier {res.get('tier')}\n")
+    for c in res.get("checkpoints", []):
+        mark = GREEN + "✓" + RST if c["ok"] else (RED + "✗" + RST)
+        print(f"  [{mark}] {c['msg']}")
+    for e in res["entries"]:
+        print(f"  seq {e['seq']} ({e['type']}){' [redacted]' if e['redacted'] else ''}:")
+        for c in e["checks"]:
+            mark = GREEN + "✓" + RST if c["ok"] else (RED + "✗" + RST)
+            tail = "" if c["fatal"] else f" {DIM}(info){RST}"
+            print(f"    [{mark}] {c['msg']}{tail}")
+
+    print("")
+    if res["ok"]:
+        print(f"{GREEN}PASS{RST} — integrity, attribution and ordering hold (not completeness).")
+        return 0
+    print(f"{RED}FAIL{RST} — a load-bearing check did not hold.")
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

touchstone_verify-0.3.2/src/touchstone_verify/_ed25519.py

@@ -0,0 +1,102 @@
+"""Pure-Python Ed25519 signature verification (RFC 8032 reference).
+
+Vendored so the verifier has zero dependencies — an auditor reads this file rather
+than trusting a compiled crypto library. Verify-only; no signing, no secret handling.
+"""
+import hashlib
+
+_p = 2**255 - 19
+_L = 2**252 + 27742317777372353535851937790883648493
+_d = (-121665 * pow(121666, _p - 2, _p)) % _p
+_I = pow(2, (_p - 1) // 4, _p)
+
+
+def _sha512(b: bytes) -> bytes:
+    return hashlib.sha512(b).digest()
+
+
+def _inv(x: int) -> int:
+    return pow(x, _p - 2, _p)
+
+
+def _x_recover(y: int) -> int:
+    xx = (y * y - 1) * _inv(_d * y * y + 1)
+    x = pow(xx, (_p + 3) // 8, _p)
+    if (x * x - xx) % _p != 0:
+        x = (x * _I) % _p
+    if x % 2 != 0:
+        x = _p - x
+    return x
+
+
+_By = (4 * _inv(5)) % _p
+_Bx = _x_recover(_By)
+_B = (_Bx % _p, _By % _p, 1, (_Bx * _By) % _p)  # extended coords (X, Y, Z, T)
+
+
+def _edwards_add(P, Q):
+    x1, y1, z1, t1 = P
+    x2, y2, z2, t2 = Q
+    a = ((y1 - x1) * (y2 - x2)) % _p
+    b = ((y1 + x1) * (y2 + x2)) % _p
+    c = (t1 * 2 * _d * t2) % _p
+    dd = (z1 * 2 * z2) % _p
+    e, f, g, h = b - a, dd - c, dd + c, b + a
+    return ((e * f) % _p, (g * h) % _p, (f * g) % _p, (e * h) % _p)
+
+
+def _scalarmult(P, e: int):
+    if e == 0:
+        return (0, 1, 1, 0)
+    Q = _scalarmult(P, e // 2)
+    Q = _edwards_add(Q, Q)
+    if e & 1:
+        Q = _edwards_add(Q, P)
+    return Q
+
+
+def _encode_point(P) -> bytes:
+    x, y, z, _ = P
+    zi = _inv(z)
+    x = (x * zi) % _p
+    y = (y * zi) % _p
+    val = y | ((x & 1) << 255)
+    return val.to_bytes(32, "little")
+
+
+def _decode_point(s: bytes):
+    y = int.from_bytes(s, "little") & ((1 << 255) - 1)
+    x = _x_recover(y)
+    if x & 1 != (int.from_bytes(s, "little") >> 255) & 1:
+        x = _p - x
+    P = (x % _p, y % _p, 1, (x * y) % _p)
+    if not _on_curve(P):
+        raise ValueError("point not on curve")
+    return P
+
+
+def _on_curve(P) -> bool:
+    x, y, z, t = P
+    zi = _inv(z)
+    x = (x * zi) % _p
+    y = (y * zi) % _p
+    return (-x * x + y * y - 1 - _d * x * x * y * y) % _p == 0
+
+
+def verify(public_key: bytes, message: bytes, signature: bytes) -> bool:
+    """True iff `signature` (64 bytes) is a valid Ed25519 signature of `message`
+    under `public_key` (32 bytes)."""
+    if len(public_key) != 32 or len(signature) != 64:
+        return False
+    try:
+        A = _decode_point(public_key)
+        R = signature[:32]
+        s = int.from_bytes(signature[32:], "little")
+        if s >= _L:
+            return False
+        h = int.from_bytes(_sha512(R + public_key + message), "little") % _L
+        left = _scalarmult(_B, s)
+        right = _edwards_add(_decode_point(R), _scalarmult(A, h))
+        return _encode_point(left) == _encode_point(right)
+    except Exception:
+        return False

touchstone_verify-0.3.2/src/touchstone_verify/verify.py

@@ -0,0 +1,318 @@
+"""Verify a Touchstone disclosure bundle — independently, with zero dependencies.
+
+A faithful port of verifier/verify.php and public/verifier.js: same JCS, entry_hash,
+signed_content, Merkle, selective-disclosure and anchor rules, so all three agree on
+the same bytes (checked against the shared conformance corpus). Checks integrity,
+attribution (subject signature, epoch-aware for key rotation), ordering, checkpoint
+append-only + server signatures + witnesses, selective-disclosure field proofs, and
+reports the external anchors. Proves tampering by anyone who is not Touchstone; it
+does not prove completeness, and says so.
+"""
+import hashlib
+import json
+
+from ._ed25519 import verify as _ed_verify
+
+
+def jcs(v) -> str:
+    """RFC 8785-ish canonical JSON, matching Canonicalizer.php + verifier.js (no
+    non-ASCII escaping, compact separators, recursive key sort)."""
+    if isinstance(v, list):
+        return "[" + ",".join(jcs(x) for x in v) + "]"
+    if isinstance(v, dict):
+        return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + jcs(v[k]) for k in sorted(v)) + "}"
+    return json.dumps(v, ensure_ascii=False, separators=(",", ":"))
+
+
+def _sha256_hex(b: bytes) -> str:
+    return hashlib.sha256(b).hexdigest()
+
+
+def _ed(pub_b64: str, msg: str, sig_b64: str) -> bool:
+    try:
+        pub = _b64(pub_b64)
+        sig = _b64(sig_b64)
+    except Exception:
+        return False
+    return _ed_verify(pub, msg.encode("utf-8"), sig)
+
+
+def _b64(s: str) -> bytes:
+    import base64
+    return base64.b64decode(s.replace("-", "+").replace("_", "/") + "===")
+
+
+def _mleaf(hex_h: str) -> str:
+    return _sha256_hex(b"\x00" + bytes.fromhex(hex_h))
+
+
+def _mnode(l: str, r: str) -> str:
+    return _sha256_hex(b"\x01" + bytes.fromhex(l) + bytes.fromhex(r))
+
+
+def _merkle_from_proof(leaf_hex: str, proof):
+    # fail-closed: malformed hash/proof (bad hex, non-list) → None, which equals no root.
+    try:
+        cur = _mleaf(leaf_hex)
+        for step in proof:
+            cur = _mnode(cur, step["hash"]) if step.get("side") == "right" else _mnode(step["hash"], cur)
+        return cur
+    except Exception:
+        return None
+
+
+def _entry_hash(e) -> str:
+    s = "\n".join([
+        str(e["seq"]), e["prev_hash"], e["server_ts"], e["payload_hash"],
+        e["actor_sub"], e.get("counterparty_sub") or "", e["actor_sig"],
+    ])
+    return _sha256_hex(s.encode("utf-8"))
+
+
+def _signed_content(recorder_id: str, e) -> str:
+    return jcs({
+        "v": 1, "recorder_id": recorder_id, "event_type": e["event_type"],
+        "actor_sub": e["actor_sub"], "counterparty_sub": e.get("counterparty_sub"),
+        "payload_hash": e["payload_hash"], "client_ts": e.get("client_ts"),
+    })
+
+
+def verify_disclosure(b: dict) -> dict:
+    """Verify a decoded touchstone-disclosure/1 bundle. Returns
+    {ok, format_ok, recorder, subject, tier, entries:[{seq,type,checks:[{ok,fatal,msg}]}],
+    checkpoints:[{ok,fatal,msg}]}. `ok` is the AND of all fatal checks."""
+    if not isinstance(b, dict) or b.get("format") != "touchstone-disclosure/1":
+        return {"ok": False, "format_ok": False, "error": "not a touchstone-disclosure/1 bundle"}
+
+    # structural guard: a malformed top-level shape rejects gracefully (never crashes).
+    rec = b.get("recorder")
+    entries = b.get("entries")
+    _cps = b.get("checkpoints")  # optional; a non-list (null, {}, …) means "none" (matches verify.php/js)
+    checkpoints = _cps if isinstance(_cps, list) else []
+    # a disclosure must carry a recorder object and a non-empty entries list (genesis at least).
+    if not isinstance(rec, dict) or not isinstance(entries, list) or not entries \
+            or not all(isinstance(e, dict) for e in entries) or not all(isinstance(c, dict) for c in checkpoints):
+        return {"ok": False, "format_ok": False, "error": "malformed bundle structure"}
+    _pid = rec.get("public_id")
+    recorder_id = _pid if isinstance(_pid, str) else ""
+    _pk = rec.get("signing_pubkey")
+    pubkey = _pk if isinstance(_pk, str) else ""
+    # only well-formed epochs participate; a malformed one is dropped (its rotated key is then
+    # untrusted → fail-closed), matching verify.php / verifier.js.
+    sk = rec.get("signing_keys")
+    epochs = [k for k in sk if isinstance(k, dict) and isinstance(k.get("from_seq"), int)
+              and not isinstance(k.get("from_seq"), bool) and isinstance(k.get("pubkey"), str)] if isinstance(sk, list) else []
+    epochs = sorted(epochs, key=lambda x: x["from_seq"])
+
+    def key_for_seq(seq: int) -> str:
+        k = pubkey
+        for ep in epochs:
+            if int(ep["from_seq"]) <= seq:
+                k = ep["pubkey"]
+            else:
+                break
+        return k
+
+    server_pub = b.get("server_pubkey")
+    server_pub = server_pub if isinstance(server_pub, str) and server_pub else None
+    cp_by_id = {cp.get("id"): cp for cp in checkpoints}
+    by_seq = {e.get("seq"): e for e in entries}
+    state = {"ok": True}
+    cp_checks = []
+
+    def cp_add(ok: bool, msg: str, fatal: bool):
+        cp_checks.append({"ok": ok, "fatal": fatal, "msg": msg})
+        if fatal and not ok:
+            state["ok"] = False
+
+    # Key epochs must be introduced by their key_rotation entry when it's in the bundle,
+    # else an attacker injects a forged epoch (see verify.php). Genesis is bound by the PoP.
+    for ep in epochs:
+        try:
+            if int(ep["from_seq"]) == 0:
+                continue
+            rot = by_seq.get(int(ep["from_seq"]) - 1)
+            if rot is None:
+                cp_add(True, f"key epoch from seq {ep['from_seq']} relies on a key_rotation entry not in this disclosure — verify the full chain", False)
+                continue
+            rb = {}
+            if rot.get("body_enc"):
+                try:
+                    rb = json.loads(rot["body_enc"])
+                except Exception:
+                    rb = {}
+            cp_add(rot.get("event_type") == "key_rotation" and rb.get("new_signing_pubkey") == ep["pubkey"],
+                   f"key epoch from seq {ep['from_seq']} introduced by its key_rotation entry", True)
+        except Exception:
+            cp_add(False, "malformed key epoch — rejected", True)
+    cp_add(True, f'attribution binds to the genesis key, which self-claims subject "{rec.get("subject_sub")}"; '
+                 f'confirm that key at /.well-known/touchstone/pubkeys/{rec.get("subject_sub")} — this bundle alone '
+                 "does not prove the subject→key binding", False)
+
+    prev_cp = None
+
+    def _is_int(x):
+        return isinstance(x, int) and not isinstance(x, bool)
+
+    for cp in sorted(cp_by_id.values(), key=lambda c: c.get("seq_start", 0) if _is_int(c.get("seq_start")) else 0):
+        try:
+            # strict checkpoint field types — reject type-confused checkpoints uniformly
+            # (matches verify.php / verifier.js).
+            if not (_is_int(cp.get("id")) and _is_int(cp.get("seq_start")) and _is_int(cp.get("seq_end"))
+                    and isinstance(cp.get("merkle_root"), str) and isinstance(cp.get("head_hash"), str)):
+                cp_add(False, "malformed checkpoint field types — rejected", True)
+                prev_cp = cp
+                continue
+            if server_pub:
+                cp_add(_ed(server_pub, cp["merkle_root"], cp.get("recorder_sig", "")),
+                       f"checkpoint #{cp['id']} root signed by Touchstone server", True)
+            else:
+                cp_add(True, f"checkpoint #{cp['id']} server signature unverifiable (no server_pubkey)", False)
+            if prev_cp is not None:
+                if int(cp["seq_start"]) > int(prev_cp["seq_end"]) + 1:
+                    cp_add(True, f"checkpoint #{cp['id']} follows #{prev_cp['id']} (intermediate checkpoints not in this disclosure)", False)
+                else:
+                    contig = int(cp["seq_start"]) == int(prev_cp["seq_end"]) + 1
+                    linked = cp.get("prev_checkpoint_hash") and cp["prev_checkpoint_hash"] == prev_cp["head_hash"]
+                    cp_add(bool(contig and linked), f"checkpoint #{cp['id']} extends #{prev_cp['id']} append-only", True)
+            for w in (cp["witnesses"] if isinstance(cp.get("witnesses"), list) else []):
+                msg = f"touchstone-cp-witness:v1:{recorder_id}:{cp['id']}:{cp['merkle_root']}:{cp['head_hash']}"
+                cp_add(_ed(w["witness_pubkey"], msg, w["witness_sig"]),
+                       f"checkpoint #{cp['id']} witnessed by {w['witness_sub']} ({w['grade']})", True)
+        except Exception:
+            cp_add(False, "malformed checkpoint — rejected", True)
+        prev_cp = cp
+
+    entries_out = []
+    for e in entries:
+        checks = []
+
+        def add(ok: bool, msg: str, fatal: bool):
+            checks.append({"ok": ok, "fatal": fatal, "msg": msg})
+            if fatal and not ok:
+                state["ok"] = False
+
+        # strict field types: reject type-confused entries uniformly instead of coercing.
+        types_ok = isinstance(e.get("seq"), int) and not isinstance(e.get("seq"), bool) \
+            and all(isinstance(e.get(f), str) for f in ("prev_hash", "entry_hash", "payload_hash", "actor_sub", "actor_sig"))
+        if "counterparty_sub" in e and e["counterparty_sub"] is not None and not isinstance(e["counterparty_sub"], str):
+            types_ok = False
+        if not types_ok:
+            add(False, "malformed entry field types — rejected", True)
+            entries_out.append({"seq": e["seq"] if isinstance(e.get("seq"), int) else -1,
+                                "type": str(e.get("event_type", "")), "redacted": False, "checks": checks})
+            continue
+
+        try:  # fail-closed: any malformed entry (missing field, bad type) → rejected
+            add(_entry_hash(e) == e["entry_hash"], "entry_hash integrity", True)
+
+            seq_key = key_for_seq(int(e["seq"]))
+            if int(e["seq"]) == 0:
+                challenge = "touchstone-pop:v1:" + rec["subject_sub"] + ":" + seq_key
+                add(_ed(seq_key, challenge, e["actor_sig"]), "genesis proof-of-possession", True)
+            else:
+                add(_ed(seq_key, _signed_content(recorder_id, e), e["actor_sig"]), "actor signature (subject key)", True)
+
+            if e.get("event_type") == "key_rotation" and e.get("body_enc"):
+                try:
+                    rb = json.loads(e["body_enc"])
+                except Exception:
+                    rb = {}
+                np = rb.get("new_signing_pubkey", "")
+                add(_ed(np, f"touchstone-rotate:v1:{recorder_id}:{np}", rb.get("new_key_pop", "")),
+                    "key rotation → new key proof-of-possession", True)
+
+            if e.get("counterparty_sig") and e.get("counterparty_pubkey"):
+                add(_ed(e["counterparty_pubkey"], _signed_content(recorder_id, e), e["counterparty_sig"]),
+                    f"counterparty co-signature ({e.get('counterparty_sub')}, {e.get('counterparty_grade', 'claimed')})", True)
+            elif e.get("counterparty_sub"):
+                add(True, f"names counterparty {e['counterparty_sub']} (awaiting co-signature)", False)
+
+            if by_seq.get(e["seq"] - 1):
+                add(e["prev_hash"] == by_seq[e["seq"] - 1]["entry_hash"], f"chain linkage to seq {e['seq'] - 1}", True)
+
+            # merkle_proof is a list (possibly empty: a single-entry checkpoint's proof IS
+            # empty, root == leaf) — run whenever present, matching verify.php/verifier.js. An
+            # empty object {} is treated as an empty list (PHP can't tell {} from [] under
+            # assoc decode, so all three normalize it the same way).
+            mp = e.get("merkle_proof")
+            if isinstance(mp, dict) and not mp:
+                mp = []
+            _cid = e.get("checkpoint_id")
+            if isinstance(mp, list) and isinstance(_cid, int) and not isinstance(_cid, bool) and cp_by_id.get(_cid):
+                cp = cp_by_id[e["checkpoint_id"]]
+                add(_merkle_from_proof(e["entry_hash"], mp) == cp["merkle_root"],
+                    f"merkle inclusion in checkpoint #{cp['id']}", True)
+                any_confirmed = False
+                for a in (cp.get("anchors") or []):
+                    if not isinstance(a, dict):
+                        continue
+                    try:
+                        blob = json.loads(a.get("token_blob") or "{}")
+                    except Exception:
+                        blob = {}
+                    if a.get("method") == "self" and a.get("status") == "confirmed":
+                        # verify the server signed the head — don't trust the status label
+                        self_ok = _ed(server_pub, cp["head_hash"], a.get("token_blob", "")) if server_pub else None
+                        if self_ok is False:
+                            add(False, f"self anchor signature INVALID (checkpoint #{cp['id']})", True)
+                        else:
+                            add(True, f"anchored (self, {a.get('external_ts')})" + (" — server signature verified" if self_ok else ""), False)
+                            any_confirmed = True
+                    elif a.get("method") == "ots" and a.get("status") == "confirmed" and blob.get("bitcoin_height"):
+                        # The height is the SERVER'S claim; this offline check does not confirm the
+                        # proof commits to that block. (Self anchors above are signature-verified;
+                        # OTS needs Bitcoin, which is out of scope for an offline tool.) Say so, and
+                        # point at how to confirm it — don't present a claim as a verified fact.
+                        add(True, f"OTS → Bitcoin block {blob['bitcoin_height']} CLAIMED ({a.get('external_ts')}) "
+                                  f"— not confirmed against mainnet here; verify the downloadable .ots with "
+                                  f"`ots verify`, which recomputes the committed root against the real block", False)
+                        any_confirmed = True
+                    elif a.get("method") == "ots":
+                        add(True, "OTS submitted, Bitcoin-pending (re-check with ots upgrade/verify)", False)
+                    elif a.get("method") == "tsa" and a.get("status") == "confirmed":
+                        add(True, f"RFC 3161 timestamp ({a.get('external_ts')}); cryptographic check: openssl ts -verify", False)
+                        any_confirmed = True
+                if not any_confirmed:
+                    add(False, "no confirmed external anchor yet", False)
+            else:
+                add(False, "not yet checkpointed/anchored (integrity+signature only)", False)
+
+            if e.get("sd"):
+                _rev = e.get("sd_revealed")
+                revealed = _rev if isinstance(_rev, list) else []  # non-list → nothing revealed (matches verify.php/js)
+                committed = None
+                ks = e.get("sd_keyset")
+                if isinstance(ks, dict) and ks:  # empty {} → treat as no key-set commitment (matches verify.php)
+                    keys = sorted(ks["keys"] if isinstance(ks.get("keys"), list) else [])
+                    ks_leaf = _sha256_hex(("tsd:keyset:v1\n" + jcs(keys)).encode("utf-8"))
+                    add(_merkle_from_proof(ks_leaf, ks.get("proof", [])) == e["payload_hash"],
+                        f"selective-disclosure key-set committed ({len(keys)} fields)", True)
+                    committed = keys
+                for f in revealed:
+                    leaf = _sha256_hex(("tsd:field:v1\n" + jcs([f["k"], f["v"], f["s"]])).encode("utf-8"))
+                    add(_merkle_from_proof(leaf, f.get("proof", [])) == e["payload_hash"],
+                        f'selective field "{f["k"]}" proven in payload_hash', True)
+                    if committed is not None:
+                        add(f["k"] in committed, f'revealed field "{f["k"]}" in committed key-set', True)
+                shown = len(revealed)
+                if committed is not None:
+                    revealed_keys = [f["k"] for f in revealed]
+                    withheld = [k for k in committed if k not in revealed_keys]
+                    add(True, f"selective disclosure: {shown} of {len(committed)} committed field(s) revealed; "
+                              f"withheld (provably sealed): {', '.join(withheld) or 'none'}", False)
+                else:
+                    count = e.get("sd_field_count", 0)
+                    add(True, f"selective disclosure: {shown} of {count} field(s) revealed (key-set not committed)", False)
+        except Exception:
+            add(False, "malformed entry — rejected", True)
+
+        _seq = e.get("seq")
+        entries_out.append({"seq": _seq if isinstance(_seq, int) else -1, "type": e.get("event_type", ""),
+                            "redacted": bool(e.get("redacted")), "checks": checks})
+
+    return {
+        "ok": state["ok"], "format_ok": True, "recorder": recorder_id,
+        "subject": rec.get("subject_sub"), "tier": rec.get("trust_tier"),
+        "entries": entries_out, "checkpoints": cp_checks,
+    }

touchstone_verify-0.3.2/src/touchstone_verify.egg-info/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: touchstone-verify
+Version: 0.3.2
+Summary: Independently verify a Touchstone disclosure — zero dependencies, pure Python.
+Author: Touchstone
+License: Apache-2.0
+Project-URL: Homepage, https://touchstone.cv
+Project-URL: Source, https://github.com/Touchstone-CV/touchstone-verify
+Keywords: touchstone,audit-log,verifier,ed25519,tamper-evident,provenance
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# touchstone-verify
+
+Independently verify a **[Touchstone](https://touchstone.cv)** disclosure — in pure Python,
+with **zero dependencies**. Read it before you trust it: it's a small, self-contained file.
+
+A disclosure is a tamper-evident slice of an agent's action log. This package re-derives,
+with no trust in Touchstone, that the slice is **intact** (entry hashes recompute), **attributed**
+(the subject's Ed25519 signature holds, epoch-aware across key rotation), and **ordered**
+(hash-chained, with checkpoints that are append-only, server-signed, and witness-co-signed). It
+also checks **selective-disclosure** field proofs and reports the external anchors. It proves
+tampering by anyone who is not Touchstone — it does **not** prove completeness, and says so.
+
+It agrees byte-for-byte with the other two Touchstone verifiers (`verify.php`, `verifier.js`):
+all three are tested against the same conformance corpus.
+
+## Install
+
+```bash
+pip install touchstone-verify
+```
+
+## Use
+
+Command line — pass a file, a URL, or a disclosure token:
+
+```bash
+touchstone-verify https://touchstone.cv/d/833cd4ca23fbb940dd71843ca47a807e
+touchstone-verify ./bundle.json
+touchstone-verify 833cd4ca23fbb940dd71843ca47a807e        # fetches from touchstone.cv
+```
+
+Exit code `0` = verified, `1` = a load-bearing check failed, `2` = couldn't load.
+
+Library:
+
+```python
+from touchstone_verify import verify_disclosure
+import json, urllib.request
+
+bundle = json.load(urllib.request.urlopen("https://touchstone.cv/d/<token>"))
+result = verify_disclosure(bundle)
+print(result["ok"])           # True / False
+for e in result["entries"]:
+    for c in e["checks"]:
+        print(c["ok"], c["msg"])
+```
+
+## What it checks
+
+- **Integrity** — every `entry_hash` recomputes from its fields.
+- **Attribution** — the subject signature verifies over the canonical signed content; genesis
+  proof-of-possession; `key_rotation` new-key PoP; counterparty co-signatures.
+- **Ordering** — `prev_hash` chain linkage; Merkle inclusion in the cited checkpoint.
+- **Checkpoints** — server signature over each Merkle root; append-only linkage between
+  consecutive checkpoints; independent witness co-signatures.
+- **Selective disclosure** — each revealed field proves Merkle inclusion in `payload_hash`;
+  withheld fields never appear in the bundle.
+
+For split-view / Bitcoin-anchor cross-checking across independent relays, see the companion
+`gossip_check.py` at <https://touchstone.cv/gossip_check.py>.
+
+## License
+
+[Apache-2.0](./LICENSE).

touchstone_verify-0.3.2/src/touchstone_verify.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/touchstone_verify/__init__.py
+src/touchstone_verify/__main__.py
+src/touchstone_verify/_ed25519.py
+src/touchstone_verify/verify.py
+src/touchstone_verify.egg-info/PKG-INFO
+src/touchstone_verify.egg-info/SOURCES.txt
+src/touchstone_verify.egg-info/dependency_links.txt
+src/touchstone_verify.egg-info/entry_points.txt
+src/touchstone_verify.egg-info/top_level.txt
+tests/test_conformance.py

touchstone_verify-0.3.2/src/touchstone_verify.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

touchstone_verify-0.3.2/src/touchstone_verify.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+touchstone-verify = touchstone_verify.__main__:main

touchstone_verify-0.3.2/src/touchstone_verify.egg-info/top_level.txt

@@ -0,0 +1 @@
+touchstone_verify

touchstone_verify-0.3.2/tests/test_conformance.py

@@ -0,0 +1,60 @@
+"""Conformance: this verifier against the shared Touchstone corpus (same fixtures
+verify.php and verifier.js check). Valid bundles pass; every documented tamper fails.
+Runnable with pytest or as a plain script: python tests/test_conformance.py
+"""
+import base64
+import copy
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
+from touchstone_verify import verify_disclosure  # noqa: E402
+
+DIR = os.path.join(os.path.dirname(__file__), "fixtures")
+
+
+def _load(name):
+    with open(os.path.join(DIR, name), encoding="utf-8") as fh:
+        return json.load(fh)
+
+
+def _first_non_genesis(b):
+    return next((e for e in b["entries"] if e["seq"] != 0), b["entries"][0])
+
+
+TAMPERS = {
+    "entry_hash": lambda b: _first_non_genesis(b).__setitem__("entry_hash", "f" * 64),
+    "actor_sig": lambda b: _first_non_genesis(b).__setitem__("actor_sig", base64.b64encode(bytes([1] * 64)).decode()),
+    "checkpoint_root": lambda b: b.get("checkpoints") and b["checkpoints"][0].__setitem__("merkle_root", "a" * 64),
+    "sd_revealed_value": lambda b: next(
+        (f.__setitem__("v", "__TAMPERED__") for e in b["entries"] if e.get("sd") for f in e.get("sd_revealed", [])[:1]),
+        None,
+    ),
+    "sd_keyset_drop": lambda b: next(
+        (e["sd_keyset"]["keys"].pop() for e in b["entries"] if e.get("sd_keyset", {}).get("keys")),
+        None,
+    ),
+    "inject_epoch": lambda b: b["recorder"].setdefault("signing_keys", []).append({"from_seq": 1, "pubkey": "A" * 43 + "="}),
+}
+
+
+def test_corpus():
+    manifest = _load("manifest.json")
+    for case in manifest["cases"]:
+        bundle = _load(case["file"])
+        res = verify_disclosure(bundle)
+        assert res["ok"] == case["expect_ok"], f"{case['file']} expected ok={case['expect_ok']}"
+        if case.get("withheld_absent"):
+            assert case["withheld_absent"] not in json.dumps(bundle), f"{case['file']} leaked withheld content"
+        for name in manifest["tampers"]:
+            t = copy.deepcopy(bundle)
+            TAMPERS[name](t)
+            if json.dumps(t) == json.dumps(bundle):
+                continue
+            assert verify_disclosure(t)["ok"] is False, f"{case['file']} tamper '{name}' must be rejected"
+
+
+if __name__ == "__main__":
+    test_corpus()
+    print("conformance OK — touchstone-verify matches the corpus on valid + tampered bundles.")