4.5 KiB
Aere Proof of Software
An attestation of what was built, from what, by whom and when, that anyone can verify without trusting Aere Network. The tool and its
documentation are in tools/proof-of-software/; start there.
The folders are laid out as in the development repository, because the tool, its tests and its GitHub Action find their two dependencies by relative path, and nothing was rewritten for publication:
| folder | what it is |
|---|---|
tools/proof-of-software/ |
pos.mjs (attest, verify, rebuild, SBOM, ML-BOM, developer credentials), its tests and negative controls, and the GitHub Action in action/ |
sdk-pq-sign/ |
the hybrid signature it uses: a classical scheme (secp256k1 or Ed25519) and ML-DSA (FIPS 204) over the same digest, both required; built on @noble |
sdk/ |
the Aere Cloud client, only for notarization and reading the on-chain proof; the same file as in aere-cloud-sdk |
Install and check
cd sdk-pq-sign && npm ci --ignore-scripts && cd ../tools/proof-of-software # the pinned @noble dependencies, integrity-checked
node test/pos.test.mjs # and the other tests below
The same line is in tools/proof-of-software/README.md. The examples there write private keys (keys.json, org.json,
dev.json); the repository's .gitignore ignores those names and node_modules/, so a git add -A in a clone where the examples
were run does not pick them up.
Node.js 22 or later, and git. Results measured on 2026-09-30 (Node.js 24.14.1, Windows; git 2.x, npm 11), except where a row gives another date; on 2026-10-21 every row was measured again from a fresh clone of this repository, alone in an empty folder, with the same figures:
| test | result | negative control |
|---|---|---|
| attestation and verification | 16/16 (tools/proof-of-software/test/pos.test.mjs) |
inside the test |
| ML-BOM of a model directory | 8/8 (tools/proof-of-software/test/model.test.mjs) |
4/4 on 2026-10-21 (tools/proof-of-software/test/model-control-negativ.mjs; it edits pos.mjs in place and restores it, so run it on a clean tree) |
| developer credential | 12/12 (tools/proof-of-software/test/credential.test.mjs) |
7/7 (tools/proof-of-software/test/credential-control-negativ.mjs) |
who signed (--signer) |
7/7 (tools/proof-of-software/test/semnatar.test.mjs) |
4/4 (tools/proof-of-software/test/semnatar-control-negativ.mjs) |
| npm SBOM from the committed lockfile | 11/11 (tools/proof-of-software/test/sbom.test.mjs) |
5/5 (tools/proof-of-software/test/sbom-control-negativ.mjs) |
| Go SBOM from the committed go.sum | 14/14 (tools/proof-of-software/test/sbom-go.test.mjs) |
8/8 (tools/proof-of-software/test/sbom-go-control-negativ.mjs) |
| .NET and Gradle SBOMs from the committed lock files | 27/27 (tools/proof-of-software/test/sbom-nuget-gradle.test.mjs) |
20/20 (tools/proof-of-software/test/sbom-nuget-gradle-control-negativ.mjs) |
| Maven SBOM from the committed lockfile.json (1.6.0) | 26/26 on 2026-10-18 and 2026-10-21 (tools/proof-of-software/test/sbom-maven.test.mjs) |
16/16 (tools/proof-of-software/test/sbom-maven-control-negativ.mjs) |
| hybrid signature library | 34/34 (sdk-pq-sign/test/pq-sign.test.mjs); its check of the ML-DSA half on chain is skipped without a Cloud key |
inside the test |
| GitHub Action | 25/25 on 2026-10-21 (tools/proof-of-software/test/action.test.mjs; long: it installs pinned dependencies from the npm registry) |
on 2026-10-21 (tools/proof-of-software/test/action-dovada.mjs, on a copy of the action, one group of guards at a time, each taken out by a condition false at run time): the eight guards in three groups (4, 2, 2), each turning exactly its own tests red and every other test of the suite green; the verdict line is DOVADA CONTROALELOR NEGATIVE: VERDE |
The GitHub Action is in this repository, which lives on git.aere.network; GitHub runs actions only from GitHub repositories, so
to use it, copy these three folders into a GitHub repository you control and point uses: at it, pinned to a full commit SHA
(tools/proof-of-software/action/README.md).
Code comments, test names and control messages are in Romanian; the command line, its output, the data formats, error messages and the documentation are in English. No third party has reviewed this code.
Licence
MIT, see LICENSE. Files: 62 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3).