@zanii/witness

An independent co-signer for a Zanii transparency log. A monitor (@zanii/monitor) watches the log for your safety; a witness goes one step further — after proving a checkpoint is append-only, it counter-signs it, so anyone else can trust that tree state without running their own monitor. Trust distributes instead of everyone re-checking.

npm install @zanii/witness

Usage

import { createWitness, verifyCosignature } from '@zanii/witness';

const witness = createWitness({ did, privateKey }); // the witness's own identity

// each round, fetch the log's current STH (GET /v1/sth):
const cosig = witness.cosign(sth, {
  // required once the log has grown since this witness last co-signed it:
  consistencyProof: proof, // GET /v1/consistency?first=<lastSize> → .proof
});

// publish `cosig`. Anyone can now verify the witness endorsed this checkpoint:
verifyCosignature(cosig, sth); // → true

cosign throws rather than sign anything it can't prove: an invalid STH signature, a shrunk log, a root that changed at a fixed size, or a failed consistency proof all mean history was rewritten — and a witness never endorses that.

A co-signature is itself a SignedTreeHead over the same (size, root), signed by the witness. The Merkle root uniquely commits the log's entire history, so co-signing the root binds the witness to that exact history.

Changelog

• 0.1.0 — initial release: createWitness, verifyCosignature, WitnessCosignature.

License

Apache-2.0.