/source/ · Rust binary · Apache-2.0

verifier-cli

v1.0.0

The single-binary signedreceipt CLI — verify, show, and canonicalise SignedReceipts envelopes from a shell. Built from the Rust source; not yet published to any package channel.

published March 2026commit 8af4c92d22 files · 124 KB

About this artefact

signedreceipt is the canonical command-line tool. Subcommands include verify (single envelope), verify-chain (sequence under a common chain_id), show (pretty-print plus signature inspection), canonicalise (emit JCS canonical bytes), and jwks fetch (retrieve and pin a producer's JWKS). It is a single statically-linked binary with no runtime dependencies.

The CLI is built from the Rust source in this repository. It is not yet released on crates.io or any other package channel, and there are no pre-built binaries to download yet. The binary itself can be pointed at any conforming producer — there is nothing CloakAPI-specific in the verifier path.

Manifest

No tarball is published yet. Below is a manifest of the source files (SHA-256 fingerprints, file count, commit).

Path	Size	SHA-256
`Cargo.toml`	1.0 KB	f8eaea2a73af35d2345534b5229a2f2e6316552dd066d417dc4e7f882ac5b4c1
`src/main.rs`	2.4 KB	eaafff179e2ce329f2b14ceca47dbb2b75b1f5133ba4f6594087e8410bdcd856
`src/cmd_verify.rs`	5.8 KB	34150db5cc3c8ab62868021f62cf76330eab48b5139f0a34344c5d39707d5c13
`src/cmd_chain.rs`	6.7 KB	ce03930db264861f249a758ba81eea5cd01a170ee9688b364d4a7a5dc3b55892
`src/cmd_jwks.rs`	3.1 KB	31a346cf6058108addca0a87dec8590072eada2ef2a9aece6ca9d6d2e6996708

22 files · 124 KB · commit 8af4c92d

Quick start

shell

# No published package yet — build from the Rust source.
# There is no crates.io, Homebrew, Scoop, or winget release at this time.

shell

# Verify a single envelope
signedreceipt verify --jwks https://api.cloakapi.io/.well-known/jwks.json receipt.json

# Verify a chain from a JSONL file
signedreceipt verify-chain --jwks ./jwks.json chain.jsonl

# Pretty-print
signedreceipt show receipt.json

Issues / questions

Bug reports, patches, and security advisories all go to the CloakAPI open-source inbox.

open-source@cloakapi.io

Back to /source/ · related: spec · conformance · implementations