verify.js

const fs = require("fs")
const crypto = require("crypto")
const nacl = require("tweetnacl")

function sha256(data) {
    return crypto.createHash("sha256").update(data).digest("hex")
}

function canonicalize(value) {

    if (Array.isArray(value)) {
        return `[${value.map(v => canonicalize(v)).join(",")}]`
    }

    if (value !== null && typeof value === "object") {

        const keys = Object.keys(value).sort()

        return `{${keys.map(k =>
            JSON.stringify(k) + ":" + canonicalize(value[k])
        ).join(",")}}`
    }

    return JSON.stringify(value)
}

function verifyArtifact(path) {

    const artifact = JSON.parse(fs.readFileSync(path))

    const signature = artifact.signature

    const sigValue = Buffer.from(signature.value, "base64")
    const pubKey = Buffer.from(signature.public_key, "base64")

    const artifactCopy = JSON.parse(JSON.stringify(artifact))

    delete artifactCopy.signature

    const canonical = canonicalize(artifactCopy)

    const message = Buffer.from(canonical)

    const hash = sha256(message)

    if (hash !== artifact.artifact_id) {
        console.log("Artifact hash mismatch")
        return
    }

    const verified = nacl.sign.detached.verify(
        message,
        sigValue,
        pubKey
    )

    if (!verified) {
        console.log("Signature verification FAILED")
        return
    }

    console.log("Artifact verification: VALID")
}

const file = process.argv[2]

if (!file) {
    console.log("Usage: node verify.js artifact.json")
    process.exit(1)
}

verifyArtifact(file)