Skip to content

v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@aoptimystic aoptimystic released this 25 May 21:51
v1.0.0
4f8e8af

First stable release.

provenex-verifier is a standalone, offline verifier for Provenex receipts. It takes a receipt and an Ed25519 public key and tells you whether the signature is valid over the canonical payload. No network calls, no telemetry, no dependency on provenex-core. Single runtime dependency: cryptography.

Install

pip install provenex-verifier

What you get

  • verify_receipt(receipt, public_key) -> VerificationResult -- top-level entry point.
  • canonicalize(receipt) -> bytes -- audit the canonical signed-payload step independently.
  • verify_inclusion_proof(leaf_hash, proof, tree_root, leaf_index, tree_size) -> bool -- RFC 6962 Merkle inclusion proof verification.
  • provenex-verify CLI: provenex-verify receipt.json --public-key audit.pub. Exit codes 0/1/2 for valid / invalid / usage error.

Why v1.0.0, not v0.x

The receipt format is at schema 2.5.0 and considered spec-stable. This library implements that spec. Any change here that breaks a previously valid receipt is a major version bump; we do not start at 0.x because there is nothing experimental about verification.

Design choices

  • Ed25519 only. HMAC-SHA256 is symmetric: anyone able to verify can forge. A third-party verifier is by definition not the producer, so HMAC receipts are out of scope and rejected with a clear unsupported signature algorithm error.
  • No network surface area. Public-key loading is local. There is no key-fetching, no TSA lookup, no telemetry. The library runs unmodified in an air-gapped environment.
  • No provenex-core dependency. The verifier reimplements canonicalization and signature checks from the spec. The cross-compatibility test pins a Merkle proof emitted by provenex-core and asserts byte-identical acceptance.

Quality bar

  • Code: 193 statements across canonical.py, merkle.py, verifier.py, cli.py.
  • Tests: 97 cases, 100% line and branch coverage, full suite under one second.
  • CI matrix: Python 3.9, 3.10, 3.11, 3.12, 3.13 on Ubuntu.
  • Negative tests: tampered signature, tampered field, wrong public key, malformed canonicalization (NaN), invalid Merkle proof, HMAC rejection, RSA-key rejection, malformed PEM, non-sequence Merkle proof.

Supply chain

This v1.0.0 release was hand-uploaded to PyPI. From v1.0.1 onward releases are built and signed by the release.yml workflow: tag push triggers build, Sigstore PyPI attestations, CycloneDX SBOM generation, cosign keyless signing of the SBOM, and a GitHub release with every artifact attached.

Verifying receipts produced by older provenex-core

Receipts at schema 2.4.0 and earlier verify against this library as long as they are Ed25519-signed. Canonicalisation rules have not changed across 2.x.

License

MIT. See LICENSE.

Assets 4
Loading