Implementations.
Apache-2.0 reference libraries plus product surfaces that ship signed receipts in production. All listed implementations passed every mandatory conformance suite at submission time.
Reference verifiers
The browser-side reference verifier at signedreceipts.org/verifier/ dispatches on the envelope's alg claim and runs JCS canonicalisation (RFC 8785) for the canonical profile (alg: ES256) or the legacy PHP-style canonicalisation for archived receipts (alg: ES512). Paste a receipt and the result panel reports which path was used.
Reference implementations
Maintained by the SignedReceipts working group. Apache-2.0 licence. SLSA 3 build provenance.
Rust crate
MSRV 1.75. Features: std, fips (aws-lc-rs CMVP #4759), wasm. Published to crates.io with provenance.
TypeScript package
Node 20+. Browser ESM build via SubtleCrypto. Zero runtime dependencies. Published to npm with provenance.
signedreceipts.org/source/reference-typescript →Verifier CLI
Binary signedreceipt. Commands: verify, verify-chain, show, canonicalise. Distributed via crates.io, Homebrew, Scoop, winget.
Go module
Go 1.22+. Pure-Go ECDSA + JCS. Compatible with the FIPS-validated crypto/ecdsa path on GOEXPERIMENT=boringcrypto.
Python package
Python 3.11+. Single-file pure-Python verifier (~400 LOC) plus a faster cryptography-backed implementation.
signedreceipts.org/source/reference-python →Product implementations
Compatibility claims attested by the listed vendor. Use the submission form to add a new entry — the working group auto-validates your conformance report and JWKS, then notifies badges@cloakapi.io.
| Product | Vendor | Language | Licence | Status | Badge |
|---|---|---|---|---|---|
| CloakAPI Gateway | CloakAPI | PHP (Laravel) | Proprietary | Compatible | SignedReceipts |
| CloakAPI Desktop | CloakAPI | Rust + Svelte | Proprietary | Compatible | SignedReceipts |
| CloakAPI Browser Extension | CloakAPI | TypeScript | Proprietary | Compatible | SignedReceipts |
| CloakAPI Browser Verifier | CloakAPI | TypeScript | Proprietary | Compatible | SignedReceipts |
Submit your implementation
Use the submission form with your CI conformance report URL, your published JWKS URL, and a contact email. The form auto-fetches and validates both URLs, persists the submission, and emails the working group at badges@cloakapi.io. See the badge program for acceptance criteria.