wehub-resource-sync
26382a7ac6
CI / Clippy (push) Failing after 15m13s
CI / Test (ubuntu-latest) (push) Failing after 16m1s
CI / Test (macos-latest) (push) Has been cancelled
CI / Test (windows-latest) (push) Has been cancelled
CI / Build (no embeddings / no ORT) (push) Has been cancelled
CI / Format (push) Has been cancelled
CI / Cookbook (Node) (push) Has been cancelled
CI / Pi Extension (Node) (push) Has been cancelled
CI / Rust SDK (lean-ctx-client) (push) Has been cancelled
CI / Embed SDK (lean-ctx-sdk) (push) Has been cancelled
CI / Python SDK (leanctx) (push) Has been cancelled
CI / Hermes Plugin (Python) (push) Has been cancelled
CI / SDK Conformance Matrix (push) Has been cancelled
CI / Coverage (push) Has been cancelled
CI / cargo-deny (push) Has been cancelled
CI / Adversarial Safety (push) Has been cancelled
CI / Benchmarks (push) Has been cancelled
CI / Output-Quality Gate (eval A/B) (push) Has been cancelled
CI / Documentation (push) Has been cancelled
CI / CI Green (push) Has been cancelled
JetBrains Plugin / Actionlint (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
CodeQL / Analyze (rust) (push) Has been cancelled
JetBrains Plugin / Validation (push) Has been cancelled
JetBrains Plugin / Build (push) Has been cancelled
JetBrains Plugin / Test (push) Has been cancelled
Security Check / Security Scan (push) Has been cancelled
43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# leanctx-verify
|
|
|
|
Standalone offline verifier for LeanCTX evidence bundles
|
|
(`evidence-bundle-v1`). For auditors: **no LeanCTX installation, no
|
|
network access, no trust in the audited system required.**
|
|
|
|
```
|
|
leanctx-verify <bundle.zip> [--pubkey <hex ed25519 key>] [--json]
|
|
```
|
|
|
|
Five independent checks, each reported PASS/FAIL:
|
|
|
|
1. archive + manifest well-formed
|
|
2. every file matches its SHA-256 in the manifest (no additions/removals)
|
|
3. audit hash chain replays from anchor to head (no edit/insert/delete/reorder)
|
|
4. manifest Ed25519 signature verifies
|
|
5. per-entry signatures verify
|
|
|
|
Exit code `0` = VALID, `1` = INVALID, `2` = usage error.
|
|
|
|
Without `--pubkey` the manifest's embedded key is used (self-attested
|
|
mode — proves internal consistency only). Auditors should obtain the
|
|
organisation's public key out-of-band; see
|
|
`docs/enterprise/reading-evidence.md` for the full auditor guide.
|
|
|
|
## Design constraints
|
|
|
|
* **Independent implementation.** This crate shares no code with the
|
|
LeanCTX engine; it implements the published contract
|
|
(`docs/contracts/evidence-bundle-v1.md`, OCP Part 4). A PASS therefore
|
|
attests the *specification*, not "two copies of the same code agree".
|
|
* **Minimal dependencies** (`ed25519-dalek`, `sha2`, `serde_json`, `zip`),
|
|
release binary statically stripped.
|
|
* **Mutation-tested.** CI flips single bytes in every payload region,
|
|
truncates the chain and swaps keys — each must produce INVALID
|
|
(`tests/verify_bundle.rs`).
|
|
|
|
## Build
|
|
|
|
```
|
|
cargo build --release # → target/release/leanctx-verify
|
|
```
|