Tags

v0.3.8

evidence-verifier v0.3.8 — first release carrying the ADR-044 Ed25519 hardening (small-order A/R reject + RFC 8032 5.1.3 x=0 reject)

v0.3.7

evidence-verifier v0.3.7 -- ADR-042 derived_from shape-check + chain field

v0.3.6

evidence-verifier 0.3.6: strict lowercase-hex signature, reject null timestamp/redaction, whole-string schema patterns (ADR-041 review LOW parity follow-up)

v0.3.5

evidence-verifier 0.3.5: close timestamp / redaction to prose-free shapes (ADR-041); schema + conformance re-vendored; evidence_verify.py regenerated

v0.3.4

evidence-verifier 0.3.4 (2026-10-09)

Satisfies Evidence Envelope specification v1.2.0 + the ADR-040 erratum.

- The unsigned top-level `host` block is rejected, not shape-checked (ADR-040):
  a bundle carrying it fails as `bundle has unexpected top-level keys (unsigned)`.
- Bundled schema re-vendored (byte-identical to evidence-envelope-spec main):
  lean top level closed; DirectoryEnvelope excludes lean seal keys so the two
  oneOf arms are disjoint; LeanManifest / LeanSection / LeanSha256Sums closed.
- Conformance vectors re-vendored (spec + engine suites); evidence_verify.py
  regenerated from the package.

v0.3.3

evidence-verifier 0.3.3: parity hardening (S1-S6 unsigned-channel allowlist, gpg key binding, path-traversal guard)

v0.3.2

evidence-verifier v0.3.2 (fail-closed robustness + JOSS packaging)

cise-v1

CiSE article reproducibility artifact snapshot (2026-10-02)

v0.3.1

v0.3.0

v0.2.5

evidence-verifier 0.2.5: Ed25519 malleability + non-canonical rejection; gpg-missing signature fails

v0.2.4

v0.2.4 - reject redaction lying about its parent; engine tamper battery 12/12

v0.2.3

v0.2.3 — accept lean single-JSON bundle (spec v1.1.0)

v0.2.2

evidence-verifier 0.2.2 — require signature by default + reject malformed data pin

v0.2.1

evidence-verifier 0.2.1

v0.2.0

evidence-verifier 0.2.0