Source artefacts.
Every SignedReceipts open-source artefact lives here, on signedreceipts.org. Reference libraries, the verifier CLI, the conformance corpus, the badge registry, and the normative spec source — all published with deterministic SHA-256 manifests and tagged at the spec ratification cadence.
The open-source family
Nine artefacts, three licences. Reference libraries and the verifier ship under Apache-2.0; the conformance corpus mixes Apache-2.0 (harness) and CC0 (vectors); the spec itself is CC-BY-4.0. Tarballs are signed with the working-group signing key and ratified at every spec revision.
reference-rust
Canonical Rust crate. JCS canonicalisation, ECDSA P-256 signing and verification, chain validation, FIPS-validated path via aws-lc-rs (CMVP #4759), no_std-friendly verifier core.
reference-typescript
Node 20+ and browser ESM build. SubtleCrypto-backed in browsers, node:crypto on Node. Zero runtime dependencies, ships as ESM-only with type declarations and SLSA 3 build provenance.
reference-go
Pure-Go ECDSA + JCS implementation with optional boringcrypto path for FIPS deployments. Ships an x/verifier sub-module suitable for embedding in middleware.
reference-python
Two-tier package: a 400-LOC pure-Python verifier with no native deps, and an optional cryptography-backed fast path. Pip-installable, wheel-only distribution with attestations.
verifier-cli
Single-binary signedreceipt CLI. Subcommands: verify, verify-chain, show, canonicalise, jwks fetch. Reproducible builds, distributed via crates.io, Homebrew, Scoop, and winget.
conformance
The conformance test corpus: 248 known-good and 187 known-bad vectors, plus an Apache-2.0 harness that drives any reference library. Vectors themselves are CC0 to make embedding trivial.
badges
The badge-claimants registry. One YAML file per claimant with the producer's published JWKS URL, conformance run hash, and a signed sample receipt. Pull-request workflow drives the public listing on /implementations/.
draft-ietf
Mirror of the Internet-Draft draft-cloakapi-signedreceipts-01 in xml2rfc v3 source. Generated .txt and .html renderings included so the IETF datatracker submission and the working-group copy stay byte-identical.
spec
The normative specification source — Markdown plus the JSON Schema and the canonical test vectors referenced from the appendices. CC-BY-4.0 so anyone can quote, fork, or translate the spec without contacting the working group.
How releases work
Tarballs are produced from a deterministic, reproducible build at every spec ratification. Each artefact ships a MANIFEST.sha256 with file-by-file fingerprints, a top-level signature over that manifest, and a copy of the working-group public key. The current ratified release is v1.0.0 — March 2026. Issues, patches, or questions go to open-source@cloakapi.io.