@jiffylabs/jtp-verify

Offline-capable CLI + library for verifying Jiffy Trust Protocol (JTP) Ed25519 attestations against the published Jiffy signing key.

Designed for CI gates, supply-chain guardrails, and air-gapped / regulated environments that cannot reach trust.jiffylabs.app at runtime.

Install / run

# Zero-install one-shot:
pnpm dlx @jiffylabs/jtp-verify ./attestation.json

# Or add to a project:
pnpm add -D @jiffylabs/jtp-verify

Requires Node.js >= 18.17 (for native fetch and Ed25519 support in node:crypto).

Usage

Online mode (default)

Fetches the current JWKS from https://trust.jiffylabs.app/.well-known/jiffy-trust-pubkey:

jtp-verify ./attestation.json

Offline mode (air-gapped / CI)

Pin a pre-downloaded JWKS file into your infrastructure repo and pass --pubkey. The CLI makes zero network calls in this mode:

# One-time: pull the current pubkey and commit it
curl https://trust.jiffylabs.app/.well-known/jiffy-trust-pubkey \
  -o ./keys/jiffy-trust-pubkey.json

# Every verify:
jtp-verify --pubkey ./keys/jiffy-trust-pubkey.json ./attestation.json

JSON output (for scripting)

jtp-verify --json --pubkey ./keys/jiffy.json ./att.json
# -> {"ok":true,"exitCode":0,"reason":"valid","kid":"jtp-2026-04","artifact":"mcp://example/",...}

Flags

| Flag | Description | | --- | --- | | --pubkey <path> | Load JWKS from a local file. Skips all network calls. | | --jwks-url <url> | Override the default JWKS URL. | | --kid <id> | Assert the attestation's signing_key_id equals this value. | | --json | Single-line JSON output instead of the human-readable summary. | | -h, --help | Show usage. | | -v, --version | Print the package version. |

Exit codes

| Code | Meaning | | --- | --- | | 0 | Attestation is valid | | 1 | Signature mismatch (tamper, wrong key) | | 2 | Revoked key, unknown kid, or unsupported alg | | 3 | Malformed attestation JSON, missing required field, or malformed --pubkey file | | 4 | Network error (only possible when --pubkey is not passed) |

Distinct exit codes let CI pipelines distinguish a tampered payload from a transient network failure from a revocation event.

Programmatic use

import { verifyAttestation, loadJwksFromFile } from '@jiffylabs/jtp-verify';

const loaded = await loadJwksFromFile('./keys/jiffy-trust-pubkey.json');
if (!loaded.ok) throw new Error(loaded.result.message);

const attestation = JSON.parse(await fs.readFile('./att.json', 'utf8'));
const result = verifyAttestation(attestation, { jwks: loaded.jwks });

if (!result.ok) {
  console.error(`verify failed: ${result.reason}`);
  process.exit(result.exitCode);
}

What gets verified

The CLI canonicalizes the attestation's signed-field subset per RFC 8785 (JSON Canonicalization Scheme) and runs Ed25519 verification against the matching JWKS entry.

Signed fields (from the JTP v0.1.0 spec):

• artifact
• type
• jts
• tier
• ioi_flags
• framework_codes
• attested_at
• attestation_id
• signing_key_id

The top-level signature field and the optional poll_url (present only for PENDING tier) are not part of the signed input.

License

Apache-2.0. Copyright Jiffy Labs.