v0.1.0

First tagged release of dedi-cli — a small CLI to generate Ed25519 keypairs, sign, and locally verify DeDi files by hand, as per DeDi protocol specifications.

What it does

• keygen — generate an Ed25519 keypair, written as a private JWK (mode 0600 on Unix)
• sign — sign an unsigned manifest or DeDi file (kind auto-detected from shape), including JSON Schema validation of records[].details against a registry's inline or URL-referenced schema, and best-effort batch signing of a whole directory
• verify — locally verify a signed document's proof.jws, either against its embedded key or an explicitly trusted public key you pass in

verify is a purely local check — it confirms the document's signature is valid, but doesn't check domain-binding, freshness, registry state, or trust-chain membership, which need a live crawl of the wider DeDi network to establish. See the README's "Deliberately out of scope" section for the full list of what this tool intentionally doesn't do.

Install

go install github.com/nfh-trust-labs/dedi-cli/cmd/dedi-cli@latest

Prefer a binary? Grab the one matching your machine below, then unzip/untar it and run dedi-cli (see the README's "Running a downloaded binary" section for macOS Gatekeeper notes):

• macOS, Apple Silicon (M1/M2/M3...): dedi-cli_0.1.0_darwin_arm64.tar.gz
• macOS, Intel: dedi-cli_0.1.0_darwin_amd64.tar.gz
• Linux: dedi-cli_0.1.0_linux_amd64.tar.gz or ..._linux_arm64.tar.gz
• Windows: dedi-cli_0.1.0_windows_amd64.zip or ..._windows_arm64.zip

Not sure which one? If you don't know your CPU architecture, amd64 is the safe default for most machines. Want to double-check your download wasn't corrupted or tampered with? Compare it against checksums.txt.