AURA-VERIFIER v1.2.2

AURA-VERIFIER v1.2.2 improves input-error reporting in the Node and browser engines.

Changes

• Public-key PEM decoding failures produce an invalid report while preserving other completed checks, including asset integrity.
• Undecodable keys do not produce fabricated fingerprints, digest-pin comparisons or non-revocation claims.
• Malformed embedded issuer keys invalidate the report independently of the signature result.
• JSON parsing errors remain rejected API promises, now identified by AuraInputError, a stable invalid_json code and the input field. For these errors, verify --json emits an input_error object and exits 2. Other runtime and file-access errors retain stderr/exit-2 behavior.
• The integrator guide documents this error contract.

Compatibility

Supported manifest versions remain 1.0 and 1.1. Historical 0.1-pilot formats remain unsupported. Keys matched as revoked in a supplied registry remain rejected under the current policy; historical validity is not assessed. Cryptographic primitives, frozen schemas, signed originals and previous archives are unchanged.

Validation

The release source tree passed Node 20, 22 and 24 regression and RFC 3161 suites, plus Chromium, Firefox and Playwright WebKit on GitHub Actions:
https://github.com/romainbenabdelkader/AURA-VERIFIER/actions/runs/41633148733

32 focused API/CLI cases were added. Each browser runs 137 NIST vectors, 58 UI report cases and five JSON-error displays, with no external page requests. Playwright WebKit is not Safari. These results are reproducible checks, not external audit certification.

Run npm test, npm run test:timestamp and npm run test:browser.

Archive series: https://doi.org/10.5281/zenodo.21251286
Previous v1.2.1 archive: https://doi.org/10.5281/zenodo.23898686

Release source commit: 08d7c70404bab16e2e3b09bb9e59aefaf6fa5391 (same source tree as tested PR commit 2fed47de0075ea4cf5b0c37a5015f5de13fc1dc4).

Verified v1.2.2 archive: https://doi.org/10.5281/zenodo.23917182

Archived file: romainbenabdelkader/AURA-VERIFIER-v1.2.2.zip (147860 bytes). All 86 source files match the released commit byte for byte.

SHA-256  512d1b8810f9f630b46737c6d8513c2ed4159c3c118ad4f9272a60b38659a21a
SHA3-256 43e907d8dbf5c64a5e1af32e928e37a927202ec7461f16985a730ef824e6f13e

These digests identify the exact ZIP stored in Zenodo. GitHub source downloads may use a different ZIP container; do not substitute their archive digest.

AURA-VERIFIER v1.2.1

AURA-VERIFIER v1.2.1 corrects the browser explanation of unchecked asset integrity.

Changes

• Distinguish a missing asset file from a supplied file whose manifest declares no asset hash.
• Handle empty files correctly in this explanation; retain a general label for malformed or unsupported hash declarations.
• Add seven UI regression cases and display the verifier version in the web interface.

Compatibility

Cryptographic engines, acceptance decisions and supported manifest versions (1.0 and 1.1) are unchanged from v1.2.0. Historical 0.1-pilot formats remain unsupported. Keys listed as revoked in a supplied registry remain rejected under the current policy; historical validity is not assessed. Signed originals, frozen schemas and previous archives are preserved.

Validation

The release source tree passed Node 20, 22 and 24 tests including RFC 3161, and the browser suite on GitHub Actions: https://github.com/romainbenabdelkader/AURA-VERIFIER/actions/runs/41534767038

Local Chromium, Firefox and Playwright WebKit each passed 52 UI cases and 137 NIST vectors with no external page requests. Playwright WebKit is not Safari.

Run npm test, npm run test:timestamp and npm run test:browser.

Release source commit: e1fa13c4fb253c2e07a99538524b869028bb62b4 (same source tree as the tested PR commit 7f0e998736de3077f1aad1cd6b2f8d603856afd0).

Archive series: https://doi.org/10.5281/zenodo.21251286
Previous v1.2.0 archive: https://doi.org/10.5281/zenodo.23857156

Verified v1.2.1 archive: https://doi.org/10.5281/zenodo.23898686

Archived file: romainbenabdelkader/AURA-VERIFIER-v1.2.1.zip (142242 bytes). All 83 source files match the released commit byte for byte.

SHA-256  d8a3b9ada26a968c8cf957e2b3f22527cc89e28319e53675be43af6b8cf04dee
SHA3-256 f3752f03b97c70c19949e870467289b407f9b7e33e4e819dfdd15770a62c6355

These digests identify the exact ZIP stored in Zenodo. GitHub source downloads may use a different ZIP container; do not substitute their archive digest. The source files remain comparable independently of the ZIP container.

AURA-VERIFIER v1.2.0

AURA-VERIFIER v1.2.0 brings together the verification and compatibility corrections since archived v1.1.0.

Changes

• Correct SHA3-256 padding at input lengths 135 modulo 136. Correct standard digests pass; the previous nonstandard digest is rejected.

• Require canonical padded Base64 and exactly 64 bytes for Ed25519 signatures in Node and WebCrypto, including zero unused pad bits.

• Validate supplied issuer registries and revocation entries; distinguish invalid structure, caller-supplied key status and unassessed registry authenticity/freshness.

• Reject duplicate JSON properties, contradictory hashes, inconsistent present identifiers, unsupported formats/algorithms and invalid Unicode.

• Add base-schema validation for AURA manifest versions 1.0 and 1.1 and detached RFC 3161 verification through Node/OpenSSL, with reproducible public test evidence.

• Clarify the current registry record's status separately from the examined signing key. An active current record does not override a revoked key verdict.

• Handle browser SPKI-import failures for canonical Ed25519 public keys through a guarded raw-key import, preserving original DER digest pins. A fixed leading-zero key fixture and malformed-wrapper controls cover the compatibility path.

Compatibility

Only manifest versions 1.0 and 1.1 are supported. Historical formats, including 0.1-pilot, remain unsupported. Previously accepted malformed inputs and noncanonical signature encodings may now fail. Preserve signed originals; do not rewrite them to obtain a passing result.

Keys listed as revoked in the supplied registry remain rejected. Mathematical signature validity and historical validity are separate; historical validity is not assessed. A declared earlier date or a later timestamp does not override this policy.

Declared dates receive syntax, calendar and offset checks. Version 1.2.0 does not compare them to a clock and does not add a future-date warning. A date-check pass is not independent timestamp evidence.

Reproduction

The suites include 137 official NIST short-message vectors, 1,025 further native-crypto comparisons and 45 shared audit scenarios. Actual Chromium, Firefox and Playwright WebKit UI tests exercise the NIST vectors and those scenarios with external requests blocked. Playwright WebKit is not Safari.

Run npm test, npm run test:timestamp and npm run demo:offline. Browser setup and reproduction are documented in docs/AUDIT_CORRECTIONS.md. Consult the GitHub Actions results for the exact released source revision.

These checks do not establish CAVP certification, qualified eIDAS timestamp status, issuer identity, legal authority, ownership or completeness of a historical corpus. Frozen schemas, signed fixtures and previous archives are preserved.

Full changes and limits: RELEASE_NOTES.md and INTEGRATORS.md in this version.

Archive series (all versions): https://doi.org/10.5281/zenodo.21251286
Historical v1.1.0 archive: https://doi.org/10.5281/zenodo.22069698
Verified v1.2.0 archive: https://doi.org/10.5281/zenodo.23857156

Archived file: romainbenabdelkader/AURA-VERIFIER-v1.2.0.zip (141181 bytes). All 83 source files match the released commit byte for byte.

SHA-256  9fa7e50ca2239a5cb2174ba2ae3e57298cc45b9ddeb0d726115d5f4ee45cd18c
SHA3-256 fe8959b54a88737f423239a5cc7e9f9636348c333c436b25152202fc22105996

These digests identify the ZIP stored in the version-specific Zenodo record; use those exact archive bytes for a new source reference. GitHub’s “Source code (zip)” button produces a different ZIP container and different archive digests, although all 83 source files are identical. Do not substitute its ZIP digest for the Zenodo artifact digest.

Source commit: 6b1a631

AURA-VERIFIER v1.1.0 — TDM profile validation

AURA-VERIFIER v1.1.0 adds independent validation of the optional AURA TDM rights-reservation profile while preserving local and offline verification.

Highlights

• validates AURA_TDM_RIGHTS_RESERVATION_V1 through both Node.js and browser verification engines;
• checks the signed declarations.tdm_opt_out: true value and SHA3-256 asset binding;
• performs locally supplied verification without remote key resolution or telemetry;
• keeps remote convenience resolution optional and clearly distinguished from offline verification;
• retains regression tests with network access blocked, including rejection of modified signed content and modified asset bytes.

Compatibility

No manifest schema, canonicalization or signature algorithm is changed. Existing AURA v1.0 and v1.1 evidence remains supported.

AURA-VERIFIER v1.0.2 - Local verification privacy

This patch release documents and tests local AURA verification privacy.

Highlights:

• local verification through both Node and browser engines;
• network access blocked during regression testing;
• zero network requests when all evidence and trust material are supplied locally;
• rejection of modified signed content;
• rejection of modified asset bytes;
• optional remote resolution clearly distinguished from offline verification.

Compatibility:

• no manifest schema change;
• no canonicalization or signature change;
• existing CLI and web-verifier inputs remain compatible.

Validation:

• npm test: passed;
• offline demonstration: passed;
• networkRequests: 0;
• no private key written to disk.

AURA-VERIFIER v1.0.1

AURA-VERIFIER is an independent CLI and browser verifier for AURA Evidence Packages. It verifies integrity, canonical payloads and Ed25519 signatures without requiring an AUTHENTICA account or backend.

AURA-VERIFIER v1.0.0

Initial AURA verifier MVP