aere-network/aere-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tools/verify-proof.mjs: a file that is not an envelope is a named refusal, and the signature scheme is bound to the key (the form served at aere.network/tools since 2026-10-03); LICENSING.md regenerated over the files the package carries

Browse Source
This commit is contained in:
Aere Network 2026-10-05 17:18:54 +03:00
parent 88a87df694
commit 1fa2ed0f46
2 changed files with 111 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
LICENSING.md
View File

@ -123,7 +123,7 @@ the section 4(b) notice of changed files), and each keeps its original notice pe
<!-- GENERAT: lista de mai jos se rescrie de unealta de licentiere din depozitul de constructie --> <!-- GENERAT: lista de mai jos se rescrie de unealta de licentiere din depozitul de constructie -->
## anchor/: every file that carries someone else's copyright (generated 2026-09-29) ## anchor/: every file that carries someone else's copyright (generated 2026-10-05)
This list is **generated from the files this package actually ships**, not written by hand: the This list is **generated from the files this package actually ships**, not written by hand: the
previous hand-written table fell behind the tree on 2026-09-12 and seven upstream files went previous hand-written table fell behind the tree on 2026-09-12 and seven upstream files went
@ -132,8 +132,8 @@ repository, and the publisher refuses to ship a package whose list disagrees wit
You do not need that tool to check the list: every row below names a file in this package, and You do not need that tool to check the list: every row below names a file in this package, and
`grep -i copyright` on it shows the same line. `grep -i copyright` on it shows the same line.
Measured 2026-09-29 over `anchor/`: **211 files**. **91** carry someone Measured 2026-10-05 over `anchor/`: **288 files**. **138** carry someone
else's copyright alone, **64** carry a shared notice naming both upstream and us, and **12** name only else's copyright alone, **68** carry a shared notice naming both upstream and us, and **38** name only
`contributors to the AERE Network`; 44 carry no copyright line at all. `contributors to the AERE Network`; 44 carry no copyright line at all.
The first two groups are the table below. A shared notice is listed too: those are precisely the The first two groups are the table below. A shared notice is listed too: those are precisely the
upstream files we changed, so section 4(b) has something to say about each of them. upstream files we changed, so section 4(b) has something to say about each of them.
@ -154,6 +154,7 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AerePqFinality.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AerePqFinality.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AerePqFinalityTags.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AerePqFinalityTags.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AerePqHeaderSeal.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/AerePqHeaderSeal.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockHashing.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockInterface.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftBlockInterface.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftExtraData.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BftExtraData.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BlockTimer.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/BlockTimer.java` | `Copyright ConsenSys AG.` | upstream |
@ -170,10 +171,16 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHashTool.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHashTool.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealCache.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealCache.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealStore.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealStore.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealWindowStore.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealed.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSealed.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSignerRegistry.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/PqSignerRegistry.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreator.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreatorFactory.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftBlockCreatorFactory.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/BftMiningCoordinator.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/PqAnchorProducer.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/blockcreation/PqAnchorProducer.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/messagewrappers/BftMessage.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/network/ValidatorPeers.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/payload/SignedData.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/ADRS.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/ADRS.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/Fors.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/Fors.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/HT.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/HT.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream |
@ -198,6 +205,8 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSASigner.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SLHDSASigner.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/WotsPlus.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/slhdsa/WotsPlus.java` | `Copyright (c) 2000-2025 The Legion of the Bouncy Castle Inc., see LICENTA-BOUNCYCASTLE.txt),` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/tools/PqRegistryHashTool.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/bft/tools/PqRegistryHashTool.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/validator/blockbased/VoteTally.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/main/java/org/hyperledger/besu/consensus/common/validator/blockbased/VoteTallyUpdater.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AerePqFinalityAuthorTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AerePqFinalityAuthorTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AerePqFinalityTagsTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/AerePqFinalityTagsTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfigTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqAnchorConfigTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
@ -217,6 +226,7 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHeightRefusalTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryHeightRefusalTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryRotationTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqRegistryRotationTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealPersistenceTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealPersistenceTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSealWindowPersistenceTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSignedHeightTest.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqSignedHeightTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqStartupHistoryTest.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqStartupHistoryTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqV2Fixture.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/PqV2Fixture.java` | `Copyright contributors to Besu.` | upstream |
@ -225,6 +235,8 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/RoundChangePqAttachGateTest.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/RoundChangePqAttachGateTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SlhDsaParallelSigningTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/common/src/test/java/org/hyperledger/besu/consensus/common/bft/slhdsa/SlhDsaParallelSigningTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Commit.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Commit.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/Proposal.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/RoundChange.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/network/QbftMessageTransmitter.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/network/QbftMessageTransmitter.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayload.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/CommitPayload.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/MessageFactory.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/payload/MessageFactory.java` | `Copyright ConsenSys AG.` | upstream |
@ -234,6 +246,7 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftBlockHeightManager.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftBlockHeightManager.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftController.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftController.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRound.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRound.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/QbftRoundFactory.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/RoundState.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/statemachine/RoundState.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/types/QbftBlockCreator.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/types/QbftBlockCreator.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidator.java` | `Copyright 2020 ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/CommitValidator.java` | `Copyright 2020 ConsenSys AG.` | upstream |
@ -245,6 +258,7 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidator.java` | `Copyright 2020 ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/PrepareValidator.java` | `Copyright 2020 ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidator.java` | `Copyright contributors to Hyperledger Besu.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/ProposalPayloadValidator.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidator.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft-core/src/main/java/org/hyperledger/besu/consensus/qbft/core/validation/RoundChangePayloadValidator.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/messagewrappers/AereD434ListBoundsTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/ProposalSealPlumbingTest.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/ProposalSealPlumbingTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/RoundChangeSealPlumbingTest.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/network/RoundChangeSealPlumbingTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayloadPqTest.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/qbft-core/src/test/java/org/hyperledger/besu/consensus/qbft/core/payload/PreparePayloadPqTest.java` | `Copyright contributors to Besu.` | upstream |
@ -269,6 +283,7 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftBlockHeaderValidationRulesetFactory.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftBlockHeaderValidationRulesetFactory.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftExtraDataCodec.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/QbftExtraDataCodec.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftBlockCreatorAdaptor.java` | `Copyright contributors to Besu.` | upstream | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftBlockCreatorAdaptor.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/adaptor/QbftFinalStateImpl.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/blockcreation/QbftBlockCreatorFactory.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/blockcreation/QbftBlockCreatorFactory.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestAttachedRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestAttachedRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
@ -278,6 +293,8 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqHeaderSealRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqHeaderSealRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqRegistryBindingRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqRegistryBindingRule.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/jsonrpc/QbftJsonRpcMethods.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/consensus/qbft/src/main/java/org/hyperledger/besu/consensus/qbft/jsonrpc/methods/AereGetPqFinality.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealLogThrottleTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealLogThrottleTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRuleRetirementTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/FalconSealValidationRuleRetirementTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRuleTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqAnchorDigestRuleTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
@ -289,12 +306,46 @@ notice (4(c)), and where we changed it the words **modified by Aere Network** ar
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRuleTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqEmergencyShoutRuleTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqForkGateFeedTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqForkGateFeedTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqHeaderSealStage5Test.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/headervalidationrules/PqHeaderSealStage5Test.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/consensus/qbft/src/test/java/org/hyperledger/besu/consensus/qbft/jsonrpc/methods/AereGetPqFinalityTest.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/datatypes/src/main/java/org/hyperledger/besu/datatypes/Address.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/datatypes/src/main/java/org/hyperledger/besu/datatypes/Transaction.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/datatypes/src/main/java/org/hyperledger/besu/datatypes/TransactionType.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/RpcMethod.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetBalance.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetBalance.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetCode.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetCode.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetStorageAt.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetStorageAt.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetTransactionCount.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/EthGetTransactionCount.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/results/TransactionBaseResult.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/websocket/subscription/pending/PendingTransactionDetailResult.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/query/BlockchainQueries.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/query/BlockchainQueries.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/AereStateUnavailableIsAnErrorTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream | | `anchor/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/methods/AereStateUnavailableIsAnErrorTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/query/AereHeadStateRetryTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream | | `anchor/ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/query/AereHeadStateRetryTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/core/Transaction.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/core/encoding/TransactionDecoder.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/core/encoding/TransactionEncoder.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/MainnetProtocolSpecs.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/MainnetTransactionProcessor.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/MainnetTransactionValidator.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/WithdrawalsValidator.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/feemarket/LondonFeeMarket.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/core/src/test-support/java/org/hyperledger/besu/ethereum/core/BlockDataGenerator.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/ethereum/core/src/test-support/java/org/hyperledger/besu/ethereum/core/TransactionTestFixture.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/core/src/test/java/org/hyperledger/besu/ethereum/mainnet/AereD432GasCapUnsignedTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/ethereum/core/src/test/java/org/hyperledger/besu/ethereum/mainnet/AereD433BftWithdrawalsTest.java` | `Copyright contributors to Besu.` | upstream |
| `anchor/ethereum/core/src/test/java/org/hyperledger/besu/ethereum/mainnet/feemarket/LondonFeeMarketAereFloorTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/manager/EthPeers.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/BlockPropagationManager.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/DownloadHeadersStep.java` | `Copyright ConsenSys AG.` | upstream | | `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/DownloadHeadersStep.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/PropagatedBlockAdoptionGate.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** | | `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/PropagatedBlockAdoptionGate.java` | `Copyright contributors to Besu / AERE Network.` | upstream, **modified by Aere Network** |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/sync/state/SyncState.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/transactions/PendingTransaction.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/eth/src/main/java/org/hyperledger/besu/ethereum/eth/transactions/TransactionPool.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/eth/src/test/java/org/hyperledger/besu/ethereum/eth/sync/state/SyncStateTest.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/ethereum/eth/src/test/java/org/hyperledger/besu/ethereum/eth/transactions/layered/BaseTransactionPoolTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/eth/src/test/java/org/hyperledger/besu/ethereum/eth/transactions/layered/LayersTest.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/ethereum/rlp/src/main/java/org/hyperledger/besu/ethereum/rlp/RLPInput.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/evm/src/main/java/org/hyperledger/besu/evm/frame/MessageFrame.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/evm/src/main/java/org/hyperledger/besu/evm/frame/TxValues.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/evm/src/main/java/org/hyperledger/besu/evm/gascalculator/FrontierGasCalculator.java` | `Copyright ConsenSys AG.` | upstream |
| `anchor/evm/src/main/java/org/hyperledger/besu/evm/precompile/MainnetPrecompiledContracts.java` | `Copyright contributors to Hyperledger Besu.` | upstream |
| `anchor/evm/src/main/java/org/hyperledger/besu/evm/precompile/P256VerifyPrecompiledContract.java` | `Copyright contributors to Besu.` | upstream |

84
tools/verify-proof.mjs
View File

@ -4,10 +4,16 @@
// A proof is an envelope { v, kind, statement, statementHash, signature?, notarization? }. This tool checks it without trusting the // A proof is an envelope { v, kind, statement, statementHash, signature?, notarization? }. This tool checks it without trusting the
// producer and, when asked to check finality, without trusting the RPC endpoint either: // producer and, when asked to check finality, without trusting the RPC endpoint either:
// //
// 1 form the envelope has a statement (object) and a statementHash (0x + 64 hex) // 1 form the file is JSON, the envelope is an object with a statement (an object, not a list) and a statementHash
// (0x + 64 hex). Whatever else the file holds (null, a number, a string, a list, text that is not JSON) is
// refused HERE, by name: this tool is run by strangers on files it has never seen, and a file it cannot read as
// an envelope is a refusal, never an exception
// 2 integrity sha256(JSON.stringify(statement)) == statementHash // 2 integrity sha256(JSON.stringify(statement)) == statementHash
// 3 signature present ? an ml-dsa-{44,65,87} signature over the canonical statement text, checked with node:crypto // 3 signature present ? an ml-dsa-{44,65,87} signature over the canonical statement text, checked with node:crypto
// (OpenSSL 3.5); a scheme this tool cannot check is reported UNMEASURED, never passed : absent // (OpenSSL 3.5). The public key must BE a key of the scheme the signature declares (2026-10-03: until then a
// signature declared ml-dsa-65 and made with an Ed25519, RSA or P-256 key was reported PASSED as ml-dsa-65); a
// signature field that is not {scheme, publicKey, signature}, or whose key cannot be parsed, FAILS; a scheme
// this tool cannot check is reported UNMEASURED, never passed : absent
// 4 finality (--rpc given, or the envelope claims a notarization) the chain's most recent anchor is verified by // 4 finality (--rpc given, or the envelope claims a notarization) the chain's most recent anchor is verified by
// verify-anchor.mjs (beside this file: every post-quantum seal of its certificate checked against the published // verify-anchor.mjs (beside this file: every post-quantum seal of its certificate checked against the published
// manifests); the header of the anchor's parent is re-encoded and must hash to the parent hash those seals signed; // manifests); the header of the anchor's parent is re-encoded and must hash to the parent hash those seals signed;
@ -71,36 +77,54 @@ export function onchainHash(b) {
// rlpDecode and mptGet live in mpt.mjs since 2026-10-02 (shared with verify-anchor.mjs, which proves the anchor contract's slot 0 // rlpDecode and mptGet live in mpt.mjs since 2026-10-02 (shared with verify-anchor.mjs, which proves the anchor contract's slot 0
// under the certified parent state, AIP-24 C4 (b)); re-exported here so that nothing that imported them from this file changes. // under the certified parent state, AIP-24 C4 (b)); re-exported here so that nothing that imported them from this file changes.
export { rlpDecode, mptGet }; export { rlpDecode, mptGet };
const level = (name, state, detail) => ({ level: name, state, detail }); const level = (name, state, detail, extra) => ({ level: name, state, detail, ...(extra || {}) });
// ---------- levels 1 and 2 ---------- // ---------- levels 1 and 2 ----------
function local(env) { function local(env, notJson = null) {
const out = []; const out = [];
const formOk = env && typeof env === 'object' && env.statement && typeof env.statement === 'object' const obj = (x) => !!x && typeof x === 'object' && !Array.isArray(x);
const formOk = obj(env) && obj(env.statement)
&& typeof env.statementHash === 'string' && /^0x[0-9a-fA-F]{64}$/.test(env.statementHash); && typeof env.statementHash === 'string' && /^0x[0-9a-fA-F]{64}$/.test(env.statementHash);
out.push(level('form', formOk ? 'PASSED' : 'FAILED', formOk ? `kind=${env.kind || env.statement.kind || '?'}` : 'the envelope lacks {statement, statementHash 0x+64 hex}')); const ce = (x) => (x === null ? 'null' : Array.isArray(x) ? 'a list' : typeof x === 'object' ? 'an object' : 'a ' + typeof x);
// read through values that exist whatever the file holds: the form check is not the only thing between such a file and an exception
const st = obj(env) ? env.statement : undefined, sh = obj(env) && typeof env.statementHash === 'string' ? env.statementHash : '';
out.push(level('form', formOk ? 'PASSED' : 'FAILED', formOk ? `kind=${String((obj(env) && env.kind) || (obj(st) && st.kind) || '?').slice(0, 80)}` : notJson ? notJson
: !obj(env) ? `the file holds ${ce(env)}, not an envelope {statement, statementHash}` : 'the envelope lacks {statement (an object), statementHash 0x+64 hex}'));
if (!formOk) return { out, text: null }; if (!formOk) return { out, text: null };
const text = JSON.stringify(env.statement); const text = String(JSON.stringify(st));
const h = '0x' + crypto.createHash('sha256').update(Buffer.from(text, 'utf8')).digest('hex'); const h = '0x' + crypto.createHash('sha256').update(Buffer.from(text, 'utf8')).digest('hex');
const ok = h === env.statementHash.toLowerCase(); const ok = h === sh.toLowerCase();
out.push(level('integrity', ok ? 'PASSED' : 'FAILED', ok ? `sha256(statement) == statementHash (${h.slice(0, 18)}..)` : `sha256(statement) is ${h.slice(0, 18)}.., not the statementHash ${env.statementHash.slice(0, 18)}..`)); out.push(level('integrity', ok ? 'PASSED' : 'FAILED', ok ? `sha256(statement) == statementHash (${h.slice(0, 18)}..)` : `sha256(statement) is ${h.slice(0, 18)}.., not the statementHash ${sh.slice(0, 18)}..`));
return { out, text: ok ? text : null }; return { out, text: ok ? text : null };
} }
// ---------- level 3 ---------- // ---------- level 3 ----------
/** does this Node.js verify ML-DSA at all (OpenSSL 3.5)? asked once, by making a key: the answer is the runtime's, not a version string's */
let mlDsaHere = null;
const canMlDsa = () => { if (mlDsaHere === null) { try { crypto.generateKeyPairSync('ml-dsa-44'); mlDsaHere = true; } catch { mlDsaHere = false; } } return mlDsaHere; };
function signature(env, text) { function signature(env, text) {
if (!env.signature) return level('signature', 'ABSENT', 'the envelope carries no signature'); if (env.signature === undefined || env.signature === null) return level('signature', 'ABSENT', 'the envelope carries no signature');
const s = env.signature; const scheme = String(s.scheme || s.alg || '').toLowerCase(); const s = env.signature;
if (['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87'].includes(scheme) && s.publicKey && s.signature) { if (typeof s !== 'object' || Array.isArray(s)) return level('signature', 'FAILED', 'the signature field is not an object {scheme, publicKey, signature}');
try { const scheme = String(typeof s.scheme === 'string' ? s.scheme : typeof s.alg === 'string' ? s.alg : '').toLowerCase();
const pub = String(s.publicKey).includes('BEGIN') ? crypto.createPublicKey(s.publicKey) if (!['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87'].includes(scheme)) return level('signature', 'UNMEASURED', `a "${scheme.slice(0, 40) || '?'}" signature is not checkable by this reference verifier (the hybrid form is checked by @aere/pq-sign)`);
: crypto.createPublicKey({ key: Buffer.from(s.publicKey, 'base64'), format: 'der', type: 'spki' }); if (typeof s.publicKey !== 'string' || !s.publicKey || typeof s.signature !== 'string' || !s.signature) return level('signature', 'FAILED', `${scheme}: the signature lacks its publicKey or its signature (two strings)`);
const sig = /^[0-9a-fA-F]+$/.test(s.signature) ? Buffer.from(s.signature, 'hex') : Buffer.from(s.signature, 'base64'); if (!canMlDsa()) return level('signature', 'UNMEASURED', `${scheme} present, but this Node.js cannot check it (OpenSSL ${process.versions.openssl}); it needs OpenSSL 3.5`);
const ok = crypto.verify(null, Buffer.from(text, 'utf8'), pub, sig); let pub;
return level('signature', ok ? 'PASSED' : 'FAILED', `${scheme}: ${ok ? 'verifies' : 'does not verify'} over the canonical statement text`); try {
} catch (e) { return level('signature', 'UNMEASURED', `${scheme} present, but node:crypto cannot check it here (${String(e.message).split('\n')[0].slice(0, 60)}); it needs OpenSSL 3.5`); } pub = s.publicKey.includes('BEGIN') ? crypto.createPublicKey(s.publicKey)
} : crypto.createPublicKey({ key: Buffer.from(s.publicKey, 'base64'), format: 'der', type: 'spki' });
return level('signature', 'UNMEASURED', `a "${scheme || '?'}" signature is not checkable by this reference verifier (the hybrid form is checked by @aere/pq-sign)`); } catch (e) { return level('signature', 'FAILED', `${scheme}: the public key cannot be parsed (${String(e.message).split('\n')[0].slice(0, 60)})`); }
// the key must be a key of the scheme declared: crypto.verify(null, ...) verifies with whatever key it is handed, so without this a
// classical signature (Ed25519, RSA, P-256) declared as ml-dsa-65 was reported as a post-quantum signature that verifies
const sameScheme = pub.asymmetricKeyType === scheme;
if (!sameScheme) return level('signature', 'FAILED', `${scheme} declared, but the public key is ${String(pub.asymmetricKeyType)}: a signature is checked under the scheme it declares, with a key of that scheme`);
let ok = false;
try {
const sig = /^[0-9a-fA-F]+$/.test(s.signature) ? Buffer.from(s.signature, 'hex') : Buffer.from(s.signature, 'base64');
ok = crypto.verify(null, Buffer.from(text, 'utf8'), pub, sig);
} catch { ok = false; }
return level('signature', ok ? 'PASSED' : 'FAILED', `${scheme}: ${ok ? 'verifies' : 'does not verify'} over the canonical statement text`);
} }
// ---------- level 4 ---------- // ---------- level 4 ----------
@ -161,7 +185,10 @@ export async function finality(env, o) {
const first = (logs || []).find((l) => /1$/.test(l.data)) || (logs || [])[0]; const first = (logs || []).find((l) => /1$/.test(l.data)) || (logs || [])[0];
if (first) where = `; first seen in block ${Number(BigInt(first.blockNumber))}, transaction ${first.transactionHash.slice(0, 18)}.. (located through the endpoint's logs, not part of what is certified)`; if (first) where = `; first seen in block ${Number(BigInt(first.blockNumber))}, transaction ${first.transactionHash.slice(0, 18)}.. (located through the endpoint's logs, not part of what is certified)`;
} catch { where = ''; } } catch { where = ''; }
return level('finality', 'PASSED', `post-quantum: ${certified} records this statementHash in AereNotary ${o.notary} as first seen at ${new Date(t * 1000).toISOString()} (${t})${where}`); // `certified`: the same reading as data (what the certified state holds, not what the envelope claims): a caller that needs the
// notarization time takes it from here
return level('finality', 'PASSED', `post-quantum: ${certified} records this statementHash in AereNotary ${o.notary} as first seen at ${new Date(t * 1000).toISOString()} (${t})${where}`,
{ certified: { chainId: o.chain, notary: o.notary, firstSeen: t, stateOfBlock: X, anchor: rep.anchor } });
} }
// ---------- main ---------- // ---------- main ----------
@ -174,22 +201,25 @@ const args = process.argv.slice(2);
const opt = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; }; const opt = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
const file = args.find((a, i) => !a.startsWith('--') && !(i > 0 && args[i - 1].startsWith('--') && args[i - 1] !== '--json')); const file = args.find((a, i) => !a.startsWith('--') && !(i > 0 && args[i - 1].startsWith('--') && args[i - 1] !== '--json'));
if (!file) { console.error('usage: node verify-proof.mjs <envelope.json> [--rpc <url>] [--chain 2800|28001] [--notary <address>] [--manifests <url|dir>] [--json]'); stop(2); } if (!file) { console.error('usage: node verify-proof.mjs <envelope.json> [--rpc <url>] [--chain 2800|28001] [--notary <address>] [--manifests <url|dir>] [--json]'); stop(2); }
let env; try { env = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) { console.error('the envelope cannot be read: ' + e.message); stop(2); } let raw; try { raw = fs.readFileSync(file, 'utf8'); } catch (e) { console.error('the envelope cannot be read: ' + e.message); stop(2); }
// a file that opens and is not JSON is not an envelope: refused at the form level, by name (a leading byte order mark is skipped)
let env, notJson = null; try { env = JSON.parse(raw.charCodeAt(0) === 0xFEFF ? raw.slice(1) : raw); } catch (e) { env = undefined; notJson = 'the file is not JSON (' + String(e.message).split('\n')[0].slice(0, 80) + ')'; }
// The chain: --chain if given; otherwise the chain the envelope's notarization declares, when it is a known chain; otherwise 2800. // The chain: --chain if given; otherwise the chain the envelope's notarization declares, when it is a known chain; otherwise 2800.
// (Before 2026-09-27 an envelope notarized on 28001, checked without --chain, was looked up on 2800 and reported INVALID.) The // (Before 2026-09-27 an envelope notarized on 28001, checked without --chain, was looked up on 2800 and reported INVALID.) The
// notary stays the known contract of that chain (or --notary): an address written in the envelope is never trusted as the notary. // notary stays the known contract of that chain (or --notary): an address written in the envelope is never trusted as the notary.
const declared = env && env.notarization && Number(env.notarization.chainId); const declared = env && typeof env === 'object' && env.notarization && Number(env.notarization.chainId);
const chain = Number(opt('--chain') || (declared && NOTARY[declared] ? declared : 2800)); const chain = Number(opt('--chain') || (declared && NOTARY[declared] ? declared : 2800));
if (!NOTARY[chain]) { console.error('unknown chain ' + chain + ' (2800 or 28001)'); stop(2); } if (!NOTARY[chain]) { console.error('unknown chain ' + chain + ' (2800 or 28001)'); stop(2); }
const o = { chain, rpcGiven: !!opt('--rpc'), rpc: opt('--rpc') || RPC_DEFAULT[chain], notary: (opt('--notary') || NOTARY[chain]).toLowerCase(), const o = { chain, rpcGiven: !!opt('--rpc'), rpc: opt('--rpc') || RPC_DEFAULT[chain], notary: (opt('--notary') || NOTARY[chain]).toLowerCase(),
manifests: opt('--manifests') || MANIFESTS_DEFAULT[chain] }; manifests: opt('--manifests') || MANIFESTS_DEFAULT[chain] };
const l = local(env); const l = local(env, notJson);
const levels = [...l.out]; const levels = [...l.out];
if (l.text) { levels.push(signature(env, l.text)); levels.push(await finality(env, o)); } if (l.text && env && typeof env === 'object') { levels.push(signature(env, l.text)); levels.push(await finality(env, o)); }
const failed = levels.some((x) => x.state === 'FAILED'); const failed = levels.some((x) => x.state === 'FAILED');
const unmeasured = levels.some((x) => x.state === 'UNMEASURED' || x.state === 'PENDING'); const unmeasured = levels.some((x) => x.state === 'UNMEASURED' || x.state === 'PENDING');
const verdict = failed ? 'INVALID' : unmeasured ? 'PARTIAL' : 'VALID'; const verdict = failed ? 'INVALID' : unmeasured ? 'PARTIAL' : 'VALID';
if (args.includes('--json')) console.log(JSON.stringify({ verdict, statementHash: env.statementHash, levels }, null, 1)); const shown = env && typeof env === 'object' && typeof env.statementHash === 'string' ? env.statementHash : null;
if (args.includes('--json')) console.log(JSON.stringify({ verdict, statementHash: shown, levels }, null, 1));
else { else {
console.log(`AERE Proof Protocol - ${path.basename(file)}`); console.log(`AERE Proof Protocol - ${path.basename(file)}`);
for (const x of levels) console.log(` [${x.state.padEnd(10)}] ${x.level}: ${x.detail}`); for (const x of levels) console.log(` [${x.state.padEnd(10)}] ${x.level}: ${x.detail}`);