szl-govsign-live

DSSE / in-toto attestation signing story of the SZLHOLDINGS/szl-govsign kernel · PAE + ECDSA P-256 signed and verified in YOUR browser via WebCrypto
initialising…
HONESTY: the keypair below is a DEMO keypair generated locally in your browser at this page-load. It is NOT an SZL production signing key, and the envelope it signs is NOT an official SZL attestation. What IS real: the kernel source fetched live below (REPORTED, keyless), the PAE spec test vector, and every hash/signature operation executed here (MEASURED-in-your-browser). If any fetch or crypto step fails, this page says UNAVAILABLE — it fabricates nothing.

1 · The kernel's PAE, cross-checked against the DSSE spec vector

The kernel's pae.py implements PAE(type, body) = "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body. This page re-implements that encoding in JS and checks it against the canonical DSSE spec test vector (PAE("http://example.com/HelloWorld", "hello world")). checking…


  
2 · Live in-browser DSSE sign & verify DEMO KEY

  
Subject digest = SHA-256 of the actually fetched pae.py bytes (computed here, now).
  The in-toto Statement v1 is PAE-encoded exactly as the kernel does, signed with the browser-generated ECDSA P-256 key, then verified.

  

    
    
  

  

  
DSSE envelope (generated here)

    
signature format: raw IEEE P1363 (r||s) as produced by WebCrypto · keyid demo-p256-inbrowser

    
…

  
demo public key (JWK, generated this page-load)


  
3 · The real kernel source REPORTED

  
Fetched keyless from huggingface.co/SZLHOLDINGS/szl-govsign (branch main) when you loaded this page — passed through verbatim.

  


  







  

    ⟨ 4TH WALL ⟩
     You are reading rendered bytes. Don’t trust them — hash them:
    
    
    
canonical source: SZLHOLDINGS/szl-govsign-live · verify from outside:
      curl -sL https://huggingface.co/spaces/SZLHOLDINGS/szl-govsign-live/resolve/main/index.html | sha256sum
    

    
Integrity & origin of this page only — never the accuracy of anything on it. Known platform delta: Hugging Face may inject one window.huggingface variables <script> into <head> of the served page, so the in-browser hash can differ from the source hash by exactly that banner — diff the two documents to see it. Distrust only differences beyond that. Doctrine v11.