Skip to content

@opena2a/atx-verify 0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Jul 18:12
atx-verify-v0.3.0
bfd8824
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

@opena2a/atx-verify 0.3.0

Strict-parse raw credential entry point + declaredPurpose signature coverage. Closes #226.

verifyCredential (new)

LocalAtxVerifier.verifyCredential(credentialJson: string | Uint8Array) verifies a credential from its wire form, strict-parsing before any field is interpreted: a duplicate object member at any depth — exact-name or fold-colliding case variant (ASCII case + U+212A Kelvin + U+017F long s, matching the Go reference verifier's foldKey) — rejects as MALFORMED with a reason naming the member. JSON.parse is last-wins on duplicates (RFC 8259 §4 parser divergence), so the object-taking verify(atx) cannot see what this rejects; wire consumers should migrate to verifyCredential. The scan is a dependency-free iterative tokenizer: escapes in member names are decoded before folding, nesting is bounded at 10000 open containers (matching Go encoding/json), and degenerate inputs (JSON null, scalars, arrays, empty/invalid text, non-UTF-8 bytes) reject MALFORMED — the method never throws.

Security fix: declaredPurpose signature coverage

0.2.0's v1.1 TBS projection omitted declaredPurpose (atx-spec §1.3a.2 rule 5), so unsigned purpose content appended to a signed credential verified successfully, and honestly-signed purposes were falsely rejected. 0.3.0 signs a present, non-empty declaredPurpose and omits absent/null/empty-object forms. If you authorize on declared purpose, upgrade.

Also

  • verify(atx) rejects null/scalar credentials as MALFORMED instead of throwing (plain-JS callers doing verify(JSON.parse(body))).
  • mldsaPresent is kept on the no Ed25519 signature verified rejection so ML-DSA-only credentials are distinguishable from unsigned ones.
  • Conformance now replays the full 20-fixture suite (pinned atx-conformance f4d40a4, vendored byte-verbatim with a CI drift gate) through the raw entry point. Reference PARSE_ERROR maps to this SDK's MALFORMED.

Provenance

Published via npm Trusted Publishing (OIDC) with SLSA v1 attestations. Verify:

npm view @opena2a/atx-verify dist.attestations --json
npm audit signatures
Assets 2
Loading