Source artefacts.
The SignedReceipts open-source artefacts are stewarded here, on signedreceipts.org. Reference libraries, the verifier CLI, the conformance corpus, the badge registry, and the normative spec source. The downloadable source distribution is still being prepared and is not yet published — the pages below describe each artefact.
The open-source family
Three licences. Reference libraries and the verifier are Apache-2.0; the conformance corpus mixes Apache-2.0 (harness) and CC0 (vectors); the spec itself is CC-BY-4.0. A signed, downloadable source distribution is being prepared and is not yet published.
reference-rust
Canonical Rust crate. JCS canonicalisation, ECDSA P-256 signing and verification, chain validation, FIPS-validated path via aws-lc-rs (CMVP #4759), no_std-friendly verifier core.
reference-typescript
Node 20+ and browser ESM build. SubtleCrypto-backed in browsers, node:crypto on Node. Zero runtime dependencies, ships as ESM-only with type declarations.
Go and Python reference libraries are planned but not yet implemented.
verifier-cli
Single-binary signedreceipt CLI. Subcommands: verify, verify-chain, show, canonicalise, jwks fetch. Built from source; not yet distributed via any package channel.
conformance
The conformance test corpus: 248 known-good and 187 known-bad vectors, plus an Apache-2.0 harness that drives any reference library. Vectors themselves are CC0 to make embedding trivial.
badges
The badge-claimants registry. One YAML file per claimant with the producer's published JWKS URL, conformance run hash, and a signed sample receipt. Pull-request workflow drives the public listing on /implementations/.
spec
The normative specification source — Markdown plus the JSON Schema and the canonical test vectors referenced from the appendices. CC-BY-4.0 so anyone can quote, fork, or translate the spec without asking permission.
How releases will work
A signed, downloadable source distribution is being prepared. Each artefact is intended to ship a MANIFEST.sha256 with file-by-file fingerprints and a top-level signature over that manifest. No tarballs are published yet. Issues, patches, or questions go to open-source@cloakapi.io.