reference-go

About this artefact

signedreceipts.org/go is the reference Go module. It provides a minimal producer API, a streaming verifier, JCS canonicalisation, and a small x/middleware sub-package that wraps a standard http.Handler and emits a signed receipt per request. The module targets Go 1.22+ and avoids cgo by default so it can be compiled to static binaries for edge deployments.

Operators that need FIPS 140-3 validated cryptography can build with GOEXPERIMENT=boringcrypto; the verifier picks up the boringcrypto crypto/ecdsa path automatically. The module's release tarball is reproducible — GOFLAGS=-trimpath plus a pinned GOTOOLCHAIN ensure the same SHA-256s on every build host.

Manifest

Quick start

go get signedreceipts.org/go@v1.0.0

package main

import (
    "context"
    sr "signedreceipts.org/go"
)

func main() {
    v, _ := sr.NewVerifierFromJWKSURL(context.Background(),
        "https://api.cloakapi.io/.well-known/jwks.json")
    if err := v.Verify(receiptBytes); err != nil {
        panic(err)
    }
}

Back to /source/ · related: spec · conformance · implementations