Verify a
certificate.

const crypto = require('crypto');

const CERT_ID = 'cer_01KS9QWHV7PHETYGQAYMHB3DM6'; // replace with the cert you're verifying
const BASE = 'https://trackorigin.io';

function sortKeysDeep(value) {
  if (Array.isArray(value)) {
    return value.map(sortKeysDeep);
  }
  if (value && typeof value === 'object') {
    return Object.keys(value)
      .sort()
      .reduce((acc, key) => {
        acc[key] = sortKeysDeep(value[key]);
        return acc;
      }, {});
  }
  return value;
}

function canonicalize(obj) {
  // JSON.stringify with no spaces, applied to a deep-sorted clone.
  // Mirrors Python's json.dumps(..., sort_keys=True, separators=(',', ':')).
  return Buffer.from(JSON.stringify(sortKeysDeep(obj)), 'utf-8');
}

(async () => {
  const cert = await fetch(`${BASE}/v1/public/certificates/${CERT_ID}`).then(r => r.json());
  const pem  = await fetch(`${BASE}/.well-known/trackorigin-public-key`).then(r => r.text());

  const publicKey = crypto.createPublicKey(pem);
  const signature = Buffer.from(cert.signature, 'base64');

  const { signature: _, ...body } = cert;
  const canonical = canonicalize(body);

  const ok = crypto.verify(null, canonical, publicKey, signature);
  if (ok) {
    console.log(`✓ Signature valid for ${CERT_ID}`);
    console.log(`  Verdict: ${cert.verdict}`);
    console.log(`  Master SHA-256: ${cert.master && cert.master.sha256}`);
  } else {
    console.log(`✗ Signature INVALID for ${CERT_ID}`);
  }
})();

#!/usr/bin/env bash
set -euo pipefail

CERT_ID="cer_01KS9QWHV7PHETYGQAYMHB3DM6"
BASE="https://trackorigin.io"

# 1. Fetch the public key
curl -fsSL "$BASE/.well-known/trackorigin-public-key" -o pubkey.pem

# 2. Fetch the certificate manifest, split signature from body
CERT_JSON="$(curl -fsSL "$BASE/v1/public/certificates/$CERT_ID")"

# Extract the signature (base64) and decode to raw bytes
echo "$CERT_JSON" | jq -r '.signature' | base64 -d > signature.bin

# Canonicalize the body: sort keys recursively, compact, drop signature field
echo "$CERT_JSON" | jq -cS 'del(.signature)' | tr -d '\n' > canonical.json

# 3. Verify with openssl
if openssl pkeyutl -verify \
    -pubin -inkey pubkey.pem \
    -rawin -in canonical.json \
    -sigfile signature.bin > /dev/null 2>&1; then
  echo "✓ Signature valid for $CERT_ID"
else
  echo "✗ Signature INVALID for $CERT_ID"
  exit 1
fi