mirror of
https://github.com/saymrwulf/proof-aware-crypto-tooling-agent.git
synced 2026-09-03 19:53:43 +00:00
mrwulf
b8ffbafa7f
The dogfood principle now runs in BOTH directions. Agents already
verified signatures through the proven dalek path; now the provider
SIGNS with it too, and proves to itself that the signing code is in its
own log before every signature:
- dogfood binary gains a `sign` mode (seed over stdin, never argv;
ed25519_dalek::SigningKey from the same pinned merkleized workspace).
Honesty ledger unchanged: the library's VERIFY path is
certificate-covered; its signing path is declared trusted base - but
it is the ATTESTED artifact, not an un-attested third implementation.
- sign_payload_ed25519_detailed: signing dispatch mirroring the verify
dispatch; the backend that actually signed is recorded in every
attestation signature block and STH.
- THE SELF-REFERENTIAL CHECK: before signing any tree head, the
provider runs the SAME Merkle inclusion verification an agent runs -
against the very tree it is about to sign - for the newest leaf
attesting the signing library itself, and embeds the result in the
signature block:
signing_provenance:
signing_backend: verified-dalek-serial
signing_library_component: dalek-ed25519-verified
signing_library_source_commit: aa0f6ab...
self_inclusion: verified
signing_library_leaf_index: 4
signing_library_certificates_proven: 16/16
A root signature that names the leaf vouching for the code that
produced it. First-append chicken-and-egg is handled honestly
(self_inclusion: library_not_in_log).
- Evidence refreshed: all four receipts re-issued under dogfood-signed
STHs; the full agent verify loop re-run green.
50/50 tests (new signing roundtrip test, skip-safe where unbuilt).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
47 lines
2 KiB
YAML
47 lines
2 KiB
YAML
schema_version: 1
|
|
type: pacta.transparency.receipt.v1
|
|
log_id: 205e4c389cb143e08f0d2d58bdc8e425e47e3cbe7f2108cc58bbe835d2cc41d7
|
|
hash_algorithm: RFC9162_SHA256
|
|
attestation_path: provider/out/betrusted-ed25519.attestation.yaml
|
|
attestation_digest_sha256: 5bd2a597d712a6a80e6ba82baabcdbbbd54bc913e8a77375a6ae42e2cb7b1c57
|
|
leaf_index: 7
|
|
leaf_hash: 2791c352956ebc620a4fe12b20bfd6faa0813238c5bc0563fa4eb0130d829247
|
|
tree_size: 8
|
|
inclusion_proof:
|
|
- bdde4e4b87cd263b5914dbbae0c85ceed468c3054596f6ca79121e54cc6a134e
|
|
- f3724e66715b582c384cf49928d4705458475ea4293749989c483ab7fe9496ce
|
|
- 04541cffd46cf5a97d7453ed8ae681b1a1fedb879eb8c7a262e05b3176159eed
|
|
consistency:
|
|
from_tree_size: 8
|
|
from_root_hash: 9a15b9a1379edc07ae43d3fc61b52dc4446b56770bff6538e88ed98746ac2283
|
|
proof: []
|
|
status: not_applicable
|
|
sth:
|
|
schema_version: 1
|
|
type: pacta.transparency.signed_tree_head.v1
|
|
log_id: 205e4c389cb143e08f0d2d58bdc8e425e47e3cbe7f2108cc58bbe835d2cc41d7
|
|
tree_size: 8
|
|
timestamp: '2026-07-06T13:20:40Z'
|
|
root_hash: 9a15b9a1379edc07ae43d3fc61b52dc4446b56770bff6538e88ed98746ac2283
|
|
hash_algorithm: RFC9162_SHA256
|
|
signatures:
|
|
ed25519:
|
|
scheme: openssl-ed25519
|
|
signing_backend: verified-dalek-serial
|
|
status: signed
|
|
payload_digest_sha256: 72d9abbc5720f1c6f03ad6f6363a6c5587a2bfd46f67248282cdcfa8eeb8e1dd
|
|
signature_base64: Yz9T8akHXeiMJBKLgpoKTInfdV5WeuZgYzgWYEMkdaYS9NVKLpDjp1AcapJxUZ9Ft+2O2+n010yN7flODKqBBw==
|
|
public_key_fingerprint_sha256: 874c8a008a607021528b2493fa1caf059f9d5c123d29193dfabc09a6d1e7a56a
|
|
signing_provenance:
|
|
signing_backend: verified-dalek-serial
|
|
signing_library_component: dalek-ed25519-verified
|
|
signing_library_source_commit: aa0f6abc327ba2a54a534b21608ca8996cf73682
|
|
self_inclusion: verified
|
|
signing_library_leaf_index: 4
|
|
signing_library_certificates_proven: 16/16
|
|
ml_dsa:
|
|
scheme: ML-DSA-65
|
|
standard: FIPS 204
|
|
status: not_configured
|
|
reason: A backend appears available, but no ML-DSA signing key was configured
|
|
for this log.
|