From c1909c2afb08c968def30605f583c19bc51ad5d8 Mon Sep 17 00:00:00 2001 From: Aere Network Date: Sun, 18 Oct 2026 11:35:34 +0300 Subject: [PATCH] .gitattributes (text=auto eol=lf) for every checkout; README: running the tests from a fresh clone (npm ci in sdk-pq-sign first) --- .gitattributes | 1 + README.md | 2 +- tools/proof-of-software/README.md | 14 ++++++++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..6313b56 --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +* text=auto eol=lf diff --git a/README.md b/README.md index dedf9ab..5b1982d 100644 --- a/README.md +++ b/README.md @@ -44,4 +44,4 @@ the documentation are in English. No third party has reviewed this code. ## Licence -MIT, see [LICENSE](LICENSE). Files: 60 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3). +MIT, see [LICENSE](LICENSE). Files: 61 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3). diff --git a/tools/proof-of-software/README.md b/tools/proof-of-software/README.md index 7e3009a..8dde489 100644 --- a/tools/proof-of-software/README.md +++ b/tools/proof-of-software/README.md @@ -299,3 +299,17 @@ node test/sbom-maven.test.mjs # 26/26 on real lockfiles written by # refused with the reason; the SBOM of a lockfile at the repository root attested with source.path "." node test/sbom-maven-control-negativ.mjs # on a copy, 16 guards removed -> their own tests turn red ``` + +## Running the tests from a fresh clone + +`pos.mjs` has no dependencies of its own: it uses `node:crypto` and the signing SDK next to it (`../../sdk-pq-sign`), whose pinned +dependencies come from its lockfile. From a fresh clone of the published repository, install those first, then run the tests: + +``` +cd sdk-pq-sign && npm ci && cd ../tools/proof-of-software +node test/pos.test.mjs # and the others listed above +``` + +Measured on 2026-10-18 from a fresh clone on Windows: without that step every test stops at `Cannot find package '@noble/post-quantum'`; +with it, 16/16, 11/11, 14/14, 27/27, 26/26, 8/8, 12/12, 7/7. The repository carries `.gitattributes` (`* text=auto eol=lf`) so that a +checkout keeps the committed bytes of the SBOM fixtures on every platform (a CRLF checkout changes the SHA-256 of a committed `pom.xml`).