aere-network/aere-proof-of-software
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Aere Proof of Software: what was built, from what, by whom and when, verifiable without trusting Aere Network (hybrid ML-DSA signatures, rebuild from the committed tree, SBOM re-derived from the committed lockfile, developer credentials)
6 Commits 1 Branch 0 Tags 517 KiB
JavaScript 98.3%
Shell 1.7%
c3b3d99640
Go to file
Aere Network c3b3d99640 Stranger pass of 21 Oct: .gitignore for node_modules and the keys the examples write, Maven and Action rows in the table, one install line, temporary directories removed by the tests
2026-10-21 23:20:33 +03:00
sdk Citations: CITATIONS-UNRESOLVED.md generated from the published files; the top README cites the tests on their real paths under tools/proof-of-software/test/; the Cloud client file brought to the published SDK copy (O-017, 2026-10-12) 2026-10-12 06:11:12 +03:00
sdk-pq-sign Aere Proof of Software 1.4.0: an attestation of what was built, from what, by whom and when, verifiable without trusting Aere Network 2026-09-29 22:46:57 +03:00
tools/proof-of-software Stranger pass of 21 Oct: .gitignore for node_modules and the keys the examples write, Maven and Action rows in the table, one install line, temporary directories removed by the tests 2026-10-21 23:20:33 +03:00
.gitattributes .gitattributes (text=auto eol=lf) for every checkout; README: running the tests from a fresh clone (npm ci in sdk-pq-sign first) 2026-10-18 11:35:34 +03:00
.gitignore Stranger pass of 21 Oct: .gitignore for node_modules and the keys the examples write, Maven and Action rows in the table, one install line, temporary directories removed by the tests 2026-10-21 23:20:33 +03:00
CITATIONS-UNRESOLVED.md Stranger pass of 21 Oct: .gitignore for node_modules and the keys the examples write, Maven and Action rows in the table, one install line, temporary directories removed by the tests 2026-10-21 23:20:33 +03:00
LICENSE Aere Proof of Software 1.4.0: an attestation of what was built, from what, by whom and when, verifiable without trusting Aere Network 2026-09-29 22:46:57 +03:00
README.md Stranger pass of 21 Oct: .gitignore for node_modules and the keys the examples write, Maven and Action rows in the table, one install line, temporary directories removed by the tests 2026-10-21 23:20:33 +03:00

README.md

Aere Proof of Software

An attestation of what was built, from what, by whom and when, that anyone can verify without trusting Aere Network. The tool and its documentation are in tools/proof-of-software/; start there.

The folders are laid out as in the development repository, because the tool, its tests and its GitHub Action find their two dependencies by relative path, and nothing was rewritten for publication:

folder what it is
tools/proof-of-software/ pos.mjs (attest, verify, rebuild, SBOM, ML-BOM, developer credentials), its tests and negative controls, and the GitHub Action in action/
sdk-pq-sign/ the hybrid signature it uses: a classical scheme (secp256k1 or Ed25519) and ML-DSA (FIPS 204) over the same digest, both required; built on @noble
sdk/ the Aere Cloud client, only for notarization and reading the on-chain proof; the same file as in aere-cloud-sdk

Install and check

cd sdk-pq-sign && npm ci --ignore-scripts && cd ../tools/proof-of-software   # the pinned @noble dependencies, integrity-checked
node test/pos.test.mjs                                                        # and the other tests below

The same line is in tools/proof-of-software/README.md. The examples there write private keys (keys.json, org.json, dev.json); the repository's .gitignore ignores those names and node_modules/, so a git add -A in a clone where the examples were run does not pick them up.

Node.js 22 or later, and git. Results measured on 2026-09-30 (Node.js 24.14.1, Windows; git 2.x, npm 11), except where a row gives another date; on 2026-10-21 every row was measured again from a fresh clone of this repository, alone in an empty folder, with the same figures:

test result negative control
attestation and verification 16/16 (tools/proof-of-software/test/pos.test.mjs) inside the test
ML-BOM of a model directory 8/8 (tools/proof-of-software/test/model.test.mjs) 4/4 on 2026-10-21 (tools/proof-of-software/test/model-control-negativ.mjs; it edits pos.mjs in place and restores it, so run it on a clean tree)
developer credential 12/12 (tools/proof-of-software/test/credential.test.mjs) 7/7 (tools/proof-of-software/test/credential-control-negativ.mjs)
who signed (--signer) 7/7 (tools/proof-of-software/test/semnatar.test.mjs) 4/4 (tools/proof-of-software/test/semnatar-control-negativ.mjs)
npm SBOM from the committed lockfile 11/11 (tools/proof-of-software/test/sbom.test.mjs) 5/5 (tools/proof-of-software/test/sbom-control-negativ.mjs)
Go SBOM from the committed go.sum 14/14 (tools/proof-of-software/test/sbom-go.test.mjs) 8/8 (tools/proof-of-software/test/sbom-go-control-negativ.mjs)
.NET and Gradle SBOMs from the committed lock files 27/27 (tools/proof-of-software/test/sbom-nuget-gradle.test.mjs) 20/20 (tools/proof-of-software/test/sbom-nuget-gradle-control-negativ.mjs)
Maven SBOM from the committed lockfile.json (1.6.0) 26/26 on 2026-10-18 and 2026-10-21 (tools/proof-of-software/test/sbom-maven.test.mjs) 16/16 (tools/proof-of-software/test/sbom-maven-control-negativ.mjs)
hybrid signature library 34/34 (sdk-pq-sign/test/pq-sign.test.mjs); its check of the ML-DSA half on chain is skipped without a Cloud key inside the test
GitHub Action 25/25 on 2026-10-21 (tools/proof-of-software/test/action.test.mjs; long: it installs pinned dependencies from the npm registry) on 2026-10-21 (tools/proof-of-software/test/action-dovada.mjs, on a copy of the action, one group of guards at a time, each taken out by a condition false at run time): the eight guards in three groups (4, 2, 2), each turning exactly its own tests red and every other test of the suite green; the verdict line is DOVADA CONTROALELOR NEGATIVE: VERDE

The GitHub Action is in this repository, which lives on git.aere.network; GitHub runs actions only from GitHub repositories, so to use it, copy these three folders into a GitHub repository you control and point uses: at it, pinned to a full commit SHA (tools/proof-of-software/action/README.md).

Code comments, test names and control messages are in Romanian; the command line, its output, the data formats, error messages and the documentation are in English. No third party has reviewed this code.

Licence

MIT, see LICENSE. Files: 62 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3).