A signed proof pack from svp-platform/apps/cli.

This page contains no marketing. Every claim below is signed with Ed25519 and can be verified in your browser, with openssl, or with any JOSE-compatible library. If any file changes byte-for-byte, the signature breaks — including this one.

Verdict
Pass

All policy conditions satisfied.

policy_set = softinel-baseline-2026-07 · signed_at = 2026-07-24T14:01:16Z

Severity spread · 4 findings
0
Critical
0
High
0
Medium
2
Low
2
Info
Signature — verify it yourself
Verify this artifact in your browser

Runs Ed25519 signature verification via Web Crypto and re-hashes every component file. No data leaves your browser.

The verifier fetches the JWS, fetches the JWK, imports the Ed25519 key using the browser's Web Crypto API, checks the signature over the JWS signing input, and then re-hashes every component file to confirm it matches the SHA-256 recorded in the signed payload.

Ontology snapshot
Files indexed
6
Symbols captured
26
Call edges
18
External deps
3
Languages
go · gomod
Root hash (Merkle of all sources)
sha256:6a3844bdccc1f88991f42560aaf8c29234013584cea9bad480a23e2aed3ccc80
Policy conditions (5)
  • OK
    No critical findings
    no-critical-findings · 0 critical findings.
  • OK
    No known CVEs in direct dependencies
    no-known-cve-in-direct-deps · Direct dependencies checked against OSV.
  • OK
    No `eval` on untrusted input
    no-eval-on-untrusted-input · SEC-EVAL-001 gate.
  • OK
    High-severity findings ≤ 2
    high-severity-cap · 0 high-severity findings (cap 2).
  • OK
    No architectural fan-out violations
    architecture-fanout · ARCH-FANOUT-001 gate.
Findings (4)
  • lowqualityQUAL-LONG-002

    File length 280 lines — approaches maintainability threshold

    cmd/svp/main.go:1
    confidence 85%
    package main // entrypoint dispatch + cobra command tree

    Why: File exceeds the 200-line soft threshold. Not blocking on its own; consider splitting command implementations into per-command files as the CLI grows.

    Detector: svp-parser (structural metric)

    Recommendation: Move each cobra command into its own file under cmd/svp/commands/ as the command tree expands.
  • lowqualityQUAL-LONG-002

    File length 301 lines — approaches maintainability threshold

    internal/apiclient/client.go:1
    confidence 85%
    package apiclient // HTTP client for all backend services

    Why: File exceeds the 200-line soft threshold. The client wraps 4 services in one file; splitting by service surface would keep this under 200 lines.

    Detector: svp-parser (structural metric)

    Recommendation: Consider splitting into per-service files (identity.go, projects.go, snapshots.go, findings.go).
  • infosupply-chainDEP-FRESHNESS-001

    Dependency `github.com/spf13/cobra@v1.8.1` — not the latest minor

    go.mod:6
    confidence 75%
    github.com/spf13/cobra v1.8.1

    Why: cobra 1.8.1 is stable and unaffected by known CVEs. Newer minors are available with QoL improvements. Informational only — no security impact.

    Detector: svp-dependency + OSV feed

    Recommendation: Optional bump when convenient; no urgency.
  • infoqualityMETA-SNAPSHOT-CLEAN

    Clean pipeline snapshot — every gate satisfied

    go.mod:1
    confidence 100%
    module github.com/svp/cli

    Why: No critical, high, or medium findings. All policy gates pass. This snapshot is publishable without waivers.

    Detector: svp-policy (meta)

    Recommendation: Nothing to do. This is what a passing snapshot looks like.
Downloads · everything you need to verify offline
manifest.json

What this artifact is: source, commit, generator, snapshot metrics, signature reference.

graph-fingerprint.json

Every source file, its SHA-256, language, LoC, symbol estimate, plus a Merkle root over all of them.

findings.json

Every finding with rule id, precise file:line, source extract, evidence, reachability, and recommendation.

verdict.json

The policy verdict and every condition — satisfied or violated — that produced it.

evidence.jws

Ed25519 JWS compact form. Payload commits to the SHA-256 of every file above.

/.well-known/jwks.json

The public JWK used to sign this artifact. Current kid: softinel-evidence-2026-07.

Verify offline with a Unix pipeline
# 1. Fetch the JWS and the JWK curl -sSO https://softinel.com/evidence/sample-2/evidence.jws curl -sSO https://softinel.com/.well-known/jwks.json # 2. Split the JWS into header.payload and signature IFS='.' read -r H P S < evidence.jws SIGNING_INPUT="$H.$P" # 3. Decode signature and pubkey from base64url b64u_decode() { tr '_-' '/+' | awk '{ p=length%4; if(p) printf "%s%s",$0,substr("===",1,4-p); else print }' | base64 -d; } b64u_decode <<<"$S" > sig.bin jq -r '.keys[] | select(.kid=="softinel-evidence-2026-07") | .x' jwks.json | b64u_decode > pub.raw # 4. Verify (Ed25519, 32-byte raw key → OpenSSL DER wrapping) { printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00'; cat pub.raw; } > pub.der openssl pkey -inform DER -pubin -in pub.der -out pub.pem openssl pkeyutl -verify -pubin -inkey pub.pem \ -sigfile sig.bin -rawin -in <(printf '%s' "$SIGNING_INPUT") # → Signature Verified Successfully

Or use any JOSE library: Python joserfc, Node jose, Go github.com/go-jose/go-jose. Look up the key id softinel-evidence-2026-07 in the JWKS.

More artifacts
← Browse every published Softinel evidence pack