Skip to content
Kindgi

Signed export

@kindgi/specs/signed-export.schema.json, schema version 1.0.0.

The envelope every signed export answers: an approval's audit bundle (POST /v1/approvals/{approvalId}/audit-bundle), a run's provenance (POST /v1/provenance/{runId}/export) and compliance evidence (POST /v1/compliance/evidence/export). bundle is base64 of the exact bytes that were signed: the body, as sorted-key JSON with no whitespace. A verifier checks the Ed25519 signature over those bytes and re-serializes nothing. The embedded publicKey only proves the bytes weren't changed; pin the deployment's keys (GET /v1/export-signing-keys) to know who signed them. The body of an audit bundle is audit-bundle.schema.json.

  • kind ("audit-bundle" | "provenance" | "compliance"): Which export this is. Absent from older servers.
  • approvalId (string): An audit bundle's approval.
  • runId (string): A provenance export's run.
  • tenantId (string): A compliance export's tenant.
  • bundle (string, required): Base64 of the signed bytes: the body, as sorted-key JSON.
  • bundleSchemaVersion (string, required): The body's version, semver: audit bundle 2.0.0, provenance 1.2.0, compliance 1.0.0.
  • algorithm ("ed25519" | "ecdsa-p256-sha256", required): The signing key's algorithm. An ecdsa-p256-sha256 signature is IEEE P1363 r‖s. A verifier refuses an algorithm it doesn't know, naming it.
  • signingKeyId (string, required): The key that signed it: one of GET /v1/export-signing-keys.
  • signature (string, required): Base64 of the 64-byte signature over the bundle bytes: Ed25519's, or ECDSA P-256's as IEEE P1363 r‖s.
  • publicKey (string, required): The signing key's public half, PEM SPKI.
  • canonicalization ("sorted-key-json", required)
  • exportedAt (string (date-time), required): When it was signed: the same instant as the signed body's exportedAt.