coderifts/receipt-verifier

Offline verification of a CodeRifts chain receipt (test/fixtures-receipt.txt) with `node cli.js <receipt> --keys keys/coderifts-keys.json`; expected valid:true, status VERIFIED_CURRENT, exit 0.

cd <host-path> && ls -la && cat README.md 2>/dev/null | head -300
cat <host-path> 2>/dev/null | head -5; ls <host-path>; cd <host-path> && git log -1 --format=%H 2>/dev/null; ls .coldpass 2>/dev/null
cd <host-path> && grep -n '^#' README.md; which node npm python3; node -v 2>&1; ls test scripts keys docs; cat package.json | head -60
(sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm >/tmp/apt.log 2>&1; echo apt=$?) ; node -v; npm -v; cd <host-path> && sed -n 413,468p README.md
cd <host-path> && export NODE_USE_ENV_PROXY=1 && head -c 200 test/fixtures-receipt.txt; echo; node cli.js "$(cat test/fixtures-receipt.txt)" --keys keys/coderifts-keys.json; echo "exit=$?"; node cli.js "$(cat test/fixtures-receipt.txt)"; echo "default_exit=$?"; ls -la .coldpass 2>/dev/null; ls <host-path> 2>/dev/null || echo "no .coldpass yet"
cd <host-path> && mkdir -p .coldpass && python3 -I - <<'EOF'
import json
tok = open('<host-path>').read().strip()
probe = {
  "kind": "cli",
  "argv": ["/usr/bin/node", "<host-path>", tok, "--keys", "<host-path>"],
  "cwd": "<host-path>",
  "env": {"NODE_USE_ENV_PROXY": "1"}
}
json.dump(probe, open('<host-path>','w'), indent=2)
report = {
  "outcome": "working",
  "operation": "Offline verification of a CodeRifts chain receipt (test/fixtures-receipt.txt) with `node cli.js <receipt> --keys keys/coderifts-keys.json`; expected valid:true, status VERIFIED_CURRENT, exit 0.",
  "operation_scope": "Verifies signature and kid against the vendored key snapshot only. Does not verify a live demo receipt (needs a PR comment token), does not check revocation or authorization of the action. Python verifier and test suite not run (out of scope for smoke).",
  "steps": [
    "Read README.md (Requirements, Quickstart (Node), CLI reference)",
    "apt-get install -y nodejs npm (Node 18.19.1, npm 9.2.0); README requires Node >= 18, zero npm dependencies so no npm install or build step",
    "node cli.js \"$(cat test/fixtures-receipt.txt)\" --keys keys/coderifts-keys.json -> valid:true, VERIFIED_CURRENT, exit 0",
    "node cli.js \"$(cat test/fixtures-receipt.txt)\" (default vendored snapshot) -> same result, exit 0",
    "Wrote .coldpass/probe.json (kind cli)"
  ],
  "deviations": [
    "Node was not present in the guest; installed via apt-get (nodejs, npm) instead of a README installer. README does not give a specific install command for Node.",
    "Used repo fixture test/fixtures-receipt.txt as the receipt token instead of a freshly minted one from app.coderifts.com (network call, not needed for offline verification)."
  ],
  "stuck_step": None,
  "main_blocker": None,
  "suggested_fix": None
}
json.dump(report, open('<host-path>','w'), indent=2)
print("written")
EOF
<env-var>=<host-path> python3 -I <host-path> --validate; echo "exit=$?"