53 lines
4.5 KiB
Markdown
53 lines
4.5 KiB
Markdown
# Aere Proof of Software
|
|
|
|
An attestation of what was built, from what, by whom and when, that anyone can verify without trusting Aere Network. The tool and its
|
|
documentation are in [`tools/proof-of-software/`](tools/proof-of-software/README.md); start there.
|
|
|
|
The folders are laid out as in the development repository, because the tool, its tests and its GitHub Action find their two
|
|
dependencies by relative path, and nothing was rewritten for publication:
|
|
|
|
| folder | what it is |
|
|
|---|---|
|
|
| [`tools/proof-of-software/`](tools/proof-of-software/) | `pos.mjs` (attest, verify, rebuild, SBOM, ML-BOM, developer credentials), its tests and negative controls, and the GitHub Action in `action/` |
|
|
| [`sdk-pq-sign/`](sdk-pq-sign/) | the hybrid signature it uses: a classical scheme (secp256k1 or Ed25519) and ML-DSA (FIPS 204) over the same digest, both required; built on `@noble` |
|
|
| [`sdk/`](sdk/) | the Aere Cloud client, only for notarization and reading the on-chain proof; the same file as in `aere-cloud-sdk` |
|
|
|
|
## Install and check
|
|
|
|
```
|
|
cd sdk-pq-sign && npm ci --ignore-scripts && cd ../tools/proof-of-software # the pinned @noble dependencies, integrity-checked
|
|
node test/pos.test.mjs # and the other tests below
|
|
```
|
|
|
|
The same line is in `tools/proof-of-software/README.md`. The examples there write private keys (`keys.json`, `org.json`,
|
|
`dev.json`); the repository's `.gitignore` ignores those names and `node_modules/`, so a `git add -A` in a clone where the examples
|
|
were run does not pick them up.
|
|
|
|
Node.js 22 or later, and git. Results measured on 2026-09-30 (Node.js 24.14.1, Windows; git 2.x, npm 11), except where a row gives
|
|
another date; on 2026-10-21 every row was measured again from a fresh clone of this repository, alone in an empty folder, with the
|
|
same figures:
|
|
|
|
| test | result | negative control |
|
|
|---|---|---|
|
|
| attestation and verification | 16/16 (`tools/proof-of-software/test/pos.test.mjs`) | inside the test |
|
|
| ML-BOM of a model directory | 8/8 (`tools/proof-of-software/test/model.test.mjs`) | 4/4 on 2026-10-21 (`tools/proof-of-software/test/model-control-negativ.mjs`; it edits `pos.mjs` in place and restores it, so run it on a clean tree) |
|
|
| developer credential | 12/12 (`tools/proof-of-software/test/credential.test.mjs`) | 7/7 (`tools/proof-of-software/test/credential-control-negativ.mjs`) |
|
|
| who signed (`--signer`) | 7/7 (`tools/proof-of-software/test/semnatar.test.mjs`) | 4/4 (`tools/proof-of-software/test/semnatar-control-negativ.mjs`) |
|
|
| npm SBOM from the committed lockfile | 11/11 (`tools/proof-of-software/test/sbom.test.mjs`) | 5/5 (`tools/proof-of-software/test/sbom-control-negativ.mjs`) |
|
|
| Go SBOM from the committed go.sum | 14/14 (`tools/proof-of-software/test/sbom-go.test.mjs`) | 8/8 (`tools/proof-of-software/test/sbom-go-control-negativ.mjs`) |
|
|
| .NET and Gradle SBOMs from the committed lock files | 27/27 (`tools/proof-of-software/test/sbom-nuget-gradle.test.mjs`) | 20/20 (`tools/proof-of-software/test/sbom-nuget-gradle-control-negativ.mjs`) |
|
|
| Maven SBOM from the committed lockfile.json (1.6.0) | 26/26 on 2026-10-18 and 2026-10-21 (`tools/proof-of-software/test/sbom-maven.test.mjs`) | 16/16 (`tools/proof-of-software/test/sbom-maven-control-negativ.mjs`) |
|
|
| hybrid signature library | 34/34 (`sdk-pq-sign/test/pq-sign.test.mjs`); its check of the ML-DSA half on chain is skipped without a Cloud key | inside the test |
|
|
| GitHub Action | 25/25 on 2026-10-21 (`tools/proof-of-software/test/action.test.mjs`; long: it installs pinned dependencies from the npm registry) | on 2026-10-21 (`tools/proof-of-software/test/action-dovada.mjs`, on a copy of the action, one group of guards at a time, each taken out by a condition false at run time): the eight guards in three groups (4, 2, 2), each turning exactly its own tests red and every other test of the suite green; the verdict line is `DOVADA CONTROALELOR NEGATIVE: VERDE` |
|
|
|
|
The GitHub Action is in this repository, which lives on git.aere.network; GitHub runs actions only from GitHub repositories, so
|
|
to use it, copy these three folders into a GitHub repository you control and point `uses:` at it, pinned to a full commit SHA
|
|
(`tools/proof-of-software/action/README.md`).
|
|
|
|
Code comments, test names and control messages are in Romanian; the command line, its output, the data formats, error messages and
|
|
the documentation are in English. No third party has reviewed this code.
|
|
|
|
## Licence
|
|
|
|
MIT, see [LICENSE](LICENSE). Files: 62 (tools/proof-of-software 48, sdk-pq-sign 6, sdk 3).
|