aere-network/aere-proof-of-software
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

.gitattributes (text=auto eol=lf) for every checkout; README: running the tests from a fresh clone (npm ci in sdk-pq-sign first)

Browse Source
This commit is contained in:
Aere Network 2026-10-18 11:35:34 +03:00
parent c3910c07a2
commit c1909c2afb
3 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitattributes vendored Normal file
View File

@ -0,0 +1 @@
* text=auto eol=lf

2
README.md
View File

@ -44,4 +44,4 @@ the documentation are in English. No third party has reviewed this code.
## Licence ## Licence
MIT, see [LICENSE](LICENSE). Files: 60 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3). MIT, see [LICENSE](LICENSE). Files: 61 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3).

14
tools/proof-of-software/README.md
View File

@ -299,3 +299,17 @@ node test/sbom-maven.test.mjs # 26/26 on real lockfiles written by
# refused with the reason; the SBOM of a lockfile at the repository root attested with source.path "." # refused with the reason; the SBOM of a lockfile at the repository root attested with source.path "."
node test/sbom-maven-control-negativ.mjs # on a copy, 16 guards removed -> their own tests turn red node test/sbom-maven-control-negativ.mjs # on a copy, 16 guards removed -> their own tests turn red
``` ```
## Running the tests from a fresh clone
`pos.mjs` has no dependencies of its own: it uses `node:crypto` and the signing SDK next to it (`../../sdk-pq-sign`), whose pinned
dependencies come from its lockfile. From a fresh clone of the published repository, install those first, then run the tests:
```
cd sdk-pq-sign && npm ci && cd ../tools/proof-of-software
node test/pos.test.mjs # and the others listed above
```
Measured on 2026-10-18 from a fresh clone on Windows: without that step every test stops at `Cannot find package '@noble/post-quantum'`;
with it, 16/16, 11/11, 14/14, 27/27, 26/26, 8/8, 12/12, 7/7. The repository carries `.gitattributes` (`* text=auto eol=lf`) so that a
checkout keeps the committed bytes of the SBOM fixtures on every platform (a CRLF checkout changes the SHA-256 of a committed `pom.xml`).