Developers

Verify a bundle offline

Python and TypeScript verifiers, version 0.1.0, installed from a clone of each repository. They check a bundle against its registry entry, the trust registry and a pinned trust root, with no network access, and are compared on four checks over one conformance corpus: structure, integrity, link and authorization.

$ python -m pip install ./loquitur-verify-py
$ cd loquitur-verify-py
$ loquitur-verify --version
$ loquitur-verify tests/fixtures/valid_bundle.zip --json

Packages, installed from a clone and not from a registry: loquitur-schemas 0.1.0, loquitur-verify 0.1.0, @loquitur/verify 0.1.0. Publication on PyPI and npm comes later.
1093 declared conformance runs, 0 disagreements recorded in the baseline.

The documentation site holds tutorials, how-to guides, explanation and the reference, rendered from the 0.1.0 sources of the four repositories.

Documentation See the reading order Read the protocol

Rules

Rules for implementations

A registry entry carries no evidence content. Hashes and identifiers are its only link to the bundle.
A verification report lists the checks it ran. A report without the authorization check has not failed it; that check was not requested.
Without a pinned trust root, a verifier reports REVIEW at best, never PASS.

Repositories

What is published

Loquitur is designed in four layers: the core (protocol and verifiers), public profiles per asset type, tools installed by the party that holds the evidence, and optional applications. Each depends only on the layers below it. The core exists without its transparency log: the specification, the schemas, the conformance corpus and two verifiers, published as an Alpha preview in the loquitur-dev organization on GitHub. There is no hosted service.

Specification

Protocol

The specification, one numbered text in 18 parts: the object model, the verification checks and the rules for what may appear in a registry entry. It holds the reason-code catalog, the registered vocabularies and the conformance corpus, as a data-only archive that any implementation can run against.

Repository: loquitur-protocol
Contains: Specification, reason-code catalog, vocabularies, conformance corpus

GitHub

Schemas

The JSON Schemas of the canonical objects, packaged with the reason-code catalog, canonicalization helpers and generated TypeScript declarations.

Repository: loquitur-schemas
Package: loquitur-schemas 0.1.0, to be published on PyPI later; install from a clone for now

GitHub Install

Verifier (Python)

Python verifier

Runs the structure, integrity, link and authorization checks offline, on a bundle directory or ZIP archive, and reports what it could and could not confirm.

Repository: loquitur-verify-py
Package: loquitur-verify 0.1.0, to be published on PyPI later; install from a clone for now

GitHub Install

Verifier (TypeScript)

TypeScript verifier

The second verifier, written by the same maintainer as the first and run over the same conformance corpus. Reads bundle directories.

Repository: loquitur-verify-ts
Package: @loquitur/verify 0.1.0, to be published on npm later; install from a clone for now

GitHub Install

Install

Install from a clone

Each README gives these commands, and the tabs reproduce them. Clone each repository at the release tag, install it from the clone, check the install, then run the first example the README gives.

Clone at the release tag

git clone --branch v0.1.0 https://github.com/loquitur-dev/loquitur-schemas.git
git clone --branch v0.1.0 https://github.com/loquitur-dev/loquitur-verify-py.git
git clone --branch v0.1.0 https://github.com/loquitur-dev/loquitur-verify-ts.git

Package

loquitur-schemas

Install

python -m pip install ./loquitur-schemas
loquitur-schema-validate --version

First run

loquitur-schema-validate list

Package

loquitur-verify

Install

python -m pip install ./loquitur-verify-py
cd loquitur-verify-py
loquitur-verify --version

First run

loquitur-verify tests/fixtures/valid_bundle.zip --json

Package

@loquitur/verify

Install

cd loquitur-verify-ts
npm ci
npm pack        # builds dist/ and writes loquitur-verify-0.1.0.tgz
cd ../your-project
npm install ../loquitur-verify-ts/loquitur-verify-0.1.0.tgz

First run

npm ci
npm run build
node examples/verify-test-vectors.mjs

None of the packages is on PyPI or npm. Installing the Python verifier downloads its dependencies, rfc8785 and cryptography, and the build backend, setuptools, from PyPI when they are not already cached; the verification itself needs no network.

The code, the schemas and the data are offered under MIT OR Apache-2.0, at your choice, and the text of the specification under CC BY 4.0. For the license terms, see the LICENSE-APACHE and LICENSE-MIT files in each repository, and the LICENSE-docs file in loquitur-protocol for the text of the specification. This summary is for convenience only: the license files are the only binding text, and where they differ from it, they apply.

Integration

Before you integrate

Contract

Each object is defined field by field.

The schemas and the specification define the bundle, the receipt, the summaries, the registry entry and the trust registry.

The schemas fix fields and types; the rule that ties a status to its reason codes is in the specification.

Verification

Offline verification runs four checks.

Structure of the bundle, integrity of every file and of the manifest, the link to the registry entry, and authorization of the issuer's key.

Transparency and anchoring are reserved and not implemented. The issuer's legal identity is not checked.

Engineering

Questions about an integration

Write to the maintainer about the workflow, the policy it applies and the evidence it needs.

Write to the maintainer