@codai/axiom-canon
Advanced tools
RFC 8785 JSON canonicalization, sha256 digests and in-toto Statement/SLSA provenance builders for AXIOM
Zero-dependency canonicalization and attestation primitives for AXIOM v2.
What: RFC 8785 JSON Canonicalization (JCS), sha256 content addressing
(sha256:<hex>), an in-toto Statement v1 / SLSA Provenance v1 builder, and
DSSE Pre-Authentication Encoding. Only node:crypto at runtime.
Why: every AXIOM artefact (Manifest, Plan, facts, Statement) is identified
by the hash of its canonical bytes. Deterministic serialization is what makes
manifestDigest reproducible across OSes and lets verify byte-compare
instead of trusting a parser. Lifted from codai/packages/rules-core.
canonicalize(value): string — JCS; throws CanonicalizeError on NaN,
bigint, lone surrogates. undefined members are dropped.sha256Hex, sha256Digest, digestRef, parseDigestRefcanonicalHash(value), canonicalDigestRef(value), verifyCanonical(text)buildStatement(input): InTotoStatementV1 + constants
IN_TOTO_STATEMENT_V1, SLSA_PROVENANCE_V1, AXIOM_BUILD_TYPE, AXIOM_BUILDER_IDpae(payloadType, payload): Uint8Array, DSSE_IN_TOTO_PAYLOAD_TYPEFAQs
RFC 8785 JSON canonicalization, sha256 digests and in-toto Statement/SLSA provenance builders for AXIOM
We found that @codai/axiom-canon demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.
Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.