Skip to content

v1.25.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 10:22
v1.25.0
b5cccd7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[1.25.0] - 2026-07-12

Minor release: SCITT-compatible COSE Receipts over the transparency log. Additive and backward-compatible; the vaara.receipt/v1 wire format and existing verification surfaces are unchanged.

  • vaara.attestation.cose_receipt serialises a transparency-log inclusion proof as a COSE Receipt shaped after draft-ietf-cose-merkle-tree-proofs (verifiable-data-structure type 1 / RFC 9162 SHA-256), so a SCITT-aware relying party can consume Vaara evidence. Keyless: the receipt verifies by recomputation from bytes with no key and no operator to trust, reusing transparency_log.verify_inclusion. An optional ES256 COSE_Sign1 wrapper is available for relying parties that require the operator-signed wire form and never replaces the keyless check.
  • Scope: the encoding reuses Vaara's own RFC 6962 Merkle maths, so a COSE receipt and a native inclusion proof are the same computation. Byte-exact interop against a third-party SCITT reference verifier is not yet validated.
Assets 6
Loading