quantum-sign 0.1.7

Quantum-Sign: post-quantum signatures, format, policy, and CLI in one crate
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# Verify Quantum-Sign artifacts (offline)

## Prepare trust
- Fetch `trust/*.spki` from the project release repo (the README lists friendly KIDs).
- Place them in a local `./trust` directory alongside the artifact.

## Verify an artifact
```bash
quantum-sign verify --inp app.tar.gz --sig app.qsig --trustdb ./trust
# Machine-readable report:
quantum-sign verify --json --inp app.tar.gz --sig app.qsig --trustdb ./trust
```

## What the CLI enforces
- Strict Level-5 policy: ML-DSA-87 signatures, SHA-512 or SHAKE256-64 digest.
- Canonical CBOR (`.qsig`) encoding and expected `domain` label.
- Transcript binding: algorithm, digest choice, policy hash, and message digest must match.
- ML-DSA SPKI parsing: OID `id-ml-dsa-87` with parameters absent, filename KIDs must match hashed SPKIs.
- M-of-N quorum: each signature consumes a unique trusted KID, co-sigs are bounded to 16 participants.

## Sample `--json` output
```json
{
  "status": "ok",
  "alg": "mldsa-87",
  "digest_alg": "sha512",
  "domain": "quantum-sign-v1",
  "canonical": true,
  "m": 2,
  "n": 2,
  "kids_total": 2,
  "kids_verified": 2,
  "verified_kids": ["78c4ae5ec234bc67", "d50e0c41b2cd4f29"],
  "policy_hash_hex": "…",
  "file_digest_hex": "…",
  "qsig_size": 1234
}
```