@graneth/verify

@graneth/verify

Offline verifier for Graneth's signed governance receipts. Recomputes the canonical bytes and checks the Ed25519 signature against a public key you already have — no network calls, no account, no dependencies beyond Node's built-in crypto/fs.

npx @graneth/verify receipt.json --key graneth-key.json

Don't have the key yet? Download it once (this tool won't fetch it for you):

curl -o graneth-key.json https://graneth.com/.well-known/graneth-attestation-key.json

--key accepts either that key document or a raw PEM public key. Exits 0 on a valid signature, 1 otherwise, with a human-readable reason.

What a PASS tells you — and what it does not

PASS — Ed25519 signature is valid.
  scan #4821  acme-corp/payments-api
  verdict: PASSED  (critical 0, warnings 2)
  keyId:   3ed76e31c05aecdb

The signature covers the object it was given, so a receipt can be validly signed and still not state a repository or a verdict. When that happens the tool says so rather than printing a blank:

PASS — Ed25519 signature is valid.
  scan #4821
  NOT ATTESTED: repository, verdict — the signature is valid, but
  this receipt's signed object does not carry those facts.

Exit code is still 0 in that case: the signature really is valid, and scripts key on that. What changes is that the human reading it is not left to assume the receipt attested to more than it did.

Programmatic use: import { verifyReceipt } from "@graneth/verify".

License

MIT