Skip to content

GOVP Verifier 0.1.7 (superseded)

Choose a tag to compare

View all tags
@enekosz enekosz released this 06 Aug 04:13
· 4 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.1.7
This tag was signed with the committer’s verified signature.
enekosz
SSH Key Fingerprint: ok2QPdUXHxDaknF6ESdHXkmMGaTNzlQOxrHrDEDIfeE
Verified
Learn about vigilant mode.
81b8ec3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security notice

This version is superseded by 0.1.8. Upgrade to @govp/verifier@0.1.8: version 0.1.7 can miss a GOVP-STATUS-1 revocation when the record uses alternate field-name casing. Version 0.1.8 also adds bounded status freshness, normalized JSON collision rejection and strict deterministic Ed25519 verification.

Original release

Signed release of the independent JavaScript implementation of GOVP-1 and GOVP-STATUS-1. This patch hardened the npm Trusted Publishing workflow with tag-push OIDC, GitHub-verified annotated-tag enforcement and a pinned OIDC-capable npm CLI. The attached tarball is retained for reproducibility; verify it with SHA256SUMS.

Assets 5
Loading