Sunlionet

Outside: Verification

Verification is designed for:

• operators (manual checks before distribution)
• CI (fail if any trust-critical check fails)
• Inside importer compatibility (same validation logic)

Verify from a Bundle File

Encrypted bundles (recommended):

go run -tags outside ./cmd/outside verify \
  --bundle ./dist/bundle.snb.json \
  --signer-pub ./keys/outside.ed25519.pub \
  --age-identity ./keys/inside.agekey \
  --require-decrypt

Plaintext bundles:

go run -tags outside ./cmd/outside verify \
  --bundle ./dist/bundle.snb.json \
  --signer-pub ./keys/outside.ed25519.pub

Shortcut form (supported):

go run -tags outside ./cmd/outside --verify ./dist/bundle.snb.json \
  --signer-pub ./keys/outside.ed25519.pub

Verify from a URI

go run -tags outside ./cmd/outside verify \
  --uri-file ./dist/bundle.uri.txt \
  --signer-pub ./keys/outside.ed25519.pub \
  --age-identity ./keys/inside.agekey \
  --require-decrypt

Machine-Readable Output (CI)

Use JSON output for CI parsing:

go run -tags outside ./cmd/outside verify \
  --bundle ./dist/bundle.snb.json \
  --signer-pub ./keys/outside.ed25519.pub \
  --age-identity ./keys/inside.agekey \
  --require-decrypt \
  --json

What Verification Checks

Header:

• strict JSON parsing (unknown fields rejected; no trailing JSON)
• magic, bundle_id, seq, timestamps
• expiration and clock-skew sanity
• cipher and encryption metadata consistency
• issuer metadata: publisher_key_id must match the trusted signer key id
• signature validity

Payload (requires decryption for encrypted bundles):

• strict JSON parsing and schema version
• deterministic canonical encoding (payload_bytes == canonical(payload))
• issuer metadata presence and consistency (notes.issuer_key_id, profile.source.publisher_key)
• per-profile validation and normalization rules
• duplicates and trust problems (duplicate IDs and duplicate endpoints)
• template requirements (every profile’s template key must exist; template text must be valid JSON)

This site is open source. Improve this page.