feat: validator, bundle builder and release checks for 0.1.0
- Add tools/validate.py: validates packages, and with --correction runs proposed corrections through the gate against a package without writing anything (spec/11 §11.4). The gate now refuses a proposal that fails the correction schema, rule correction.schema. - tools/load.py validates every package before loading, and with --bundle --built-from builds a scienting-bundle/1 with the FTS5 search index and bundle_meta (spec/13 §13.5). Search rows are defined per unit (sentence, cell, equation outside a sentence, figure-text) with the parent kind as context. - Roster keys carry a role, and a key with the role owner may revoke any receipt (spec/08 §8.7, spec/20); roster schema, store table and the fixture roster updated. The checker signs a trial revocation to prove the rule both ways. - A qa: receipt raises the nodes it sampled except those in its errors (spec/08 §8.2); the example paper's fidelity counts become 27 F3, 13 F2, 4 F1 and 1 F0. - The destination chooses the keyed scheme, not the text policy: hmac-team between the team's machines, hkdf-pages outside the team (spec/05 §5.8, spec/12 §12.5). - A TextQuoteSelector must repeat the anchor's plain quote and is absent for hashed or keyed anchors (spec/18 §18.3). - Add fixtures/records/suspect.json, a scienting-suspect/1 record. - Oracle: hashes are kept incrementally and checked after every correction against a full recomputation; load and write refuse unsafe manifest paths; Ed25519, HKDF and schema validation come from the cryptography and jsonschema packages; canonical JSON uses the built-in encoder with an exact RFC 8785 fallback. - The tools need Python 3.14 with cryptography and jsonschema; the py310 CI environment is dropped and the workflow runs the default only. - Resolve every [CHECK] note in the docs, READMEs and context; add CONTRIBUTING.md; every tool answers --help and refuses unknown options. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
89 files changed
+1141
-513
No files matched your search
+15
-116
@@ -1,24 +1,22 @@
|
||||
"""Keyed hashing, key derivation, Merkle roots and Ed25519.
|
||||
|
||||
Non-normative; see spec/05-hashes.md and spec/08-fidelity.md.
|
||||
Ed25519 follows the reference code of RFC 8032, section 6; it is slow and is meant only for test vectors.
|
||||
HKDF and Ed25519 come from the `cryptography` package.
|
||||
"""
|
||||
|
||||
import hashlib
|
||||
import hmac
|
||||
|
||||
from cryptography.exceptions import InvalidSignature
|
||||
from cryptography.hazmat.primitives import hashes
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
|
||||
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
|
||||
|
||||
from . import jcs
|
||||
|
||||
|
||||
def hkdf(ikm, salt, info, length=32):
|
||||
"""HKDF-SHA-256, RFC 5869."""
|
||||
prk = hmac.new(salt, ikm, hashlib.sha256).digest()
|
||||
out, t, i = b"", b"", 1
|
||||
while len(out) < length:
|
||||
t = hmac.new(prk, t + info + bytes([i]), hashlib.sha256).digest()
|
||||
out += t
|
||||
i += 1
|
||||
return out[:length]
|
||||
return HKDF(algorithm=hashes.SHA256(), length=length, salt=salt, info=info).derive(ikm)
|
||||
|
||||
|
||||
def team_key(secret):
|
||||
@@ -74,121 +72,22 @@ def receipt_items(receipt):
|
||||
|
||||
# --- Ed25519 (RFC 8032) -------------------------------------------------------
|
||||
|
||||
_p = 2**255 - 19
|
||||
_d = -121665 * pow(121666, _p - 2, _p) % _p
|
||||
_q = 2**252 + 27742317777372353535851937790883648493
|
||||
|
||||
|
||||
def _sha512(b):
|
||||
return hashlib.sha512(b).digest()
|
||||
|
||||
|
||||
def _inv(x):
|
||||
return pow(x, _p - 2, _p)
|
||||
|
||||
|
||||
def _add(P, Q):
|
||||
A = (P[1] - P[0]) * (Q[1] - Q[0]) % _p
|
||||
B = (P[1] + P[0]) * (Q[1] + Q[0]) % _p
|
||||
C = 2 * P[3] * Q[3] * _d % _p
|
||||
D = 2 * P[2] * Q[2] % _p
|
||||
E, F, G, H = B - A, D - C, D + C, B + A
|
||||
return (E * F % _p, G * H % _p, F * G % _p, E * H % _p)
|
||||
|
||||
|
||||
def _mul(s, P):
|
||||
Q = (0, 1, 1, 0)
|
||||
while s > 0:
|
||||
if s & 1:
|
||||
Q = _add(Q, P)
|
||||
P = _add(P, P)
|
||||
s >>= 1
|
||||
return Q
|
||||
|
||||
|
||||
def _equal(P, Q):
|
||||
if (P[0] * Q[2] - Q[0] * P[2]) % _p != 0:
|
||||
return False
|
||||
return (P[1] * Q[2] - Q[1] * P[2]) % _p == 0
|
||||
|
||||
|
||||
_modp_sqrt_m1 = pow(2, (_p - 1) // 4, _p)
|
||||
|
||||
|
||||
def _recover_x(y, sign):
|
||||
if y >= _p:
|
||||
return None
|
||||
x2 = (y * y - 1) * _inv(_d * y * y + 1)
|
||||
if x2 == 0:
|
||||
return None if sign else 0
|
||||
x = pow(x2, (_p + 3) // 8, _p)
|
||||
if (x * x - x2) % _p != 0:
|
||||
x = x * _modp_sqrt_m1 % _p
|
||||
if (x * x - x2) % _p != 0:
|
||||
return None
|
||||
if (x & 1) != sign:
|
||||
x = _p - x
|
||||
return x
|
||||
|
||||
|
||||
_gy = 4 * _inv(5) % _p
|
||||
_gx = _recover_x(_gy, 0)
|
||||
_G = (_gx, _gy, 1, _gx * _gy % _p)
|
||||
|
||||
|
||||
def _compress(P):
|
||||
zinv = _inv(P[2])
|
||||
x = P[0] * zinv % _p
|
||||
y = P[1] * zinv % _p
|
||||
return int.to_bytes(y | ((x & 1) << 255), 32, "little")
|
||||
|
||||
|
||||
def _decompress(s):
|
||||
if len(s) != 32:
|
||||
return None
|
||||
y = int.from_bytes(s, "little")
|
||||
sign = y >> 255
|
||||
y &= (1 << 255) - 1
|
||||
x = _recover_x(y, sign)
|
||||
if x is None:
|
||||
return None
|
||||
return (x, y, 1, x * y % _p)
|
||||
|
||||
|
||||
def _secret_expand(secret):
|
||||
h = _sha512(secret)
|
||||
a = int.from_bytes(h[:32], "little")
|
||||
a &= (1 << 254) - 8
|
||||
a |= 1 << 254
|
||||
return a, h[32:]
|
||||
|
||||
|
||||
def ed25519_public(secret):
|
||||
a, _ = _secret_expand(secret)
|
||||
return _compress(_mul(a, _G))
|
||||
"""The 32-byte public key of a 32-byte Ed25519 secret."""
|
||||
return Ed25519PrivateKey.from_private_bytes(secret).public_key().public_bytes_raw()
|
||||
|
||||
|
||||
def ed25519_sign(secret, msg):
|
||||
a, prefix = _secret_expand(secret)
|
||||
A = _compress(_mul(a, _G))
|
||||
r = int.from_bytes(_sha512(prefix + msg), "little") % _q
|
||||
R = _compress(_mul(r, _G))
|
||||
h = int.from_bytes(_sha512(R + A + msg), "little") % _q
|
||||
s = (r + h * a) % _q
|
||||
return R + int.to_bytes(s, 32, "little")
|
||||
return Ed25519PrivateKey.from_private_bytes(secret).sign(msg)
|
||||
|
||||
|
||||
def ed25519_verify(public, msg, signature):
|
||||
"""True when `signature` is a valid Ed25519 signature of `msg` under `public`; never raises."""
|
||||
if len(public) != 32 or len(signature) != 64:
|
||||
return False
|
||||
A = _decompress(public)
|
||||
if not A:
|
||||
try:
|
||||
Ed25519PublicKey.from_public_bytes(public).verify(signature, msg)
|
||||
except (InvalidSignature, ValueError):
|
||||
return False
|
||||
R = _decompress(signature[:32])
|
||||
if not R:
|
||||
return False
|
||||
s = int.from_bytes(signature[32:], "little")
|
||||
if s >= _q:
|
||||
return False
|
||||
h = int.from_bytes(_sha512(signature[:32] + public + msg), "little") % _q
|
||||
return _equal(_mul(s, _G), _add(R, _mul(h, A)))
|
||||
return True
|
||||
Reference in new issue
Block a user