Expand verifier test coverage: canonicalize primitives, anchor states, demo-mode signatures - #12
Closed
smq9sn5jck-coder wants to merge 3 commits into
Closed
Expand verifier test coverage: canonicalize primitives, anchor states, demo-mode signatures#12smq9sn5jck-coder wants to merge 3 commits into
smq9sn5jck-coder wants to merge 3 commits into
Conversation
The verifier's signature check used the streaming createVerify("Ed25519")
API, which throws "Invalid digest" on modern Node because Ed25519 is a pure
(non-prehashed) scheme with no digest algorithm. As a result, check 3
(signature) errored for every certificate signed with a registered key,
making genuine certificates unverifiable. Switch to the one-shot
crypto.verify(null, ...) API, which is the correct path for Ed25519.
Add a vitest suite (25 tests) covering:
- canonicalize (key sorting, recursion, undefined/null handling, stability)
- sha256Hex (known vectors, format, sensitivity)
- computeMerkleRoot (empty/single/odd-leaf duplication, tamper- and
order-sensitivity)
- verifyCertificate happy path (valid signed cert VERIFIES), plus tamper and
failure detection for signature, Merkle, hash-consistency, issuer trust,
malformed JSON, missing fields, and registry fallback.
Also stop tracking node_modules/ and dist/ (build artifacts that the original
.gitignore intended to ignore but a malformed entry let slip into the repo).
https://claude.ai/code/session_01K7HrPZYmFR4Ld35oXwLKXX
The repository had no CI. Add a workflow that installs deps, type-checks via the build step, and runs the new vitest suite so signature/Merkle regressions are caught automatically. https://claude.ai/code/session_01K7HrPZYmFR4Ld35oXwLKXX
…natures Adds nine cases to the verifier suite: canonicalize of booleans/numbers/ top-level primitives and empty containers; the anchor 'present but no proof' warn branch and the Rekor-only pass branch; the demo-mode signature path (unregistered key) for both the 64-char warn case and the unrecognized-format fail case; and a non-200 registry response falling back to the pinned set.
Owner
Author
|
Closing without merging — superseded by work already merged to This branch was cut before #8, #9, and #11 landed. Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds nine cases to the verifier suite, covering branches the existing tests didn't reach. No source changes — tests only. Suite goes from 24 → 33 passing.
What's covered
canonicalizeprimitives: booleans, numbers, top-level strings/null/undefined, and empty objects/arrays.Test run
npx vitest run→ 33 passed.https://claude.ai/code/session_01K7HrPZYmFR4Ld35oXwLKXX
Generated by Claude Code