|
| 1 | +--- |
| 2 | +"@hypercerts-org/lexicon": minor |
| 3 | +--- |
| 4 | + |
| 5 | +Add cryptographic signature support to all lexicons |
| 6 | + |
| 7 | +Adds optional cryptographic signature support to all record lexicons, enabling platform attestation and verification that records were created through trusted services. This is inspired by the [ATProtocol Attestation Specification](https://ngerakines.leaflet.pub/3m3idxul5hc2r) by Nick Gerakines. |
| 8 | + |
| 9 | +**New lexicons:** |
| 10 | + |
| 11 | +- `app.certified.signature.inline` - Inline cryptographic signature object with JOSE algorithm identifiers (ES256, ES256K, Ed25519) |
| 12 | +- `app.certified.signature.list` - Container object with `signatures` array supporting both inline signatures and remote attestation references |
| 13 | +- `app.certified.signature.proof` - Remote attestation proof record containing the CID of attested content |
| 14 | + |
| 15 | +**Changes to existing lexicons:** |
| 16 | + |
| 17 | +All 19 record lexicons now include an optional `signatureData` property that references `app.certified.signature.list`: |
| 18 | + |
| 19 | +- `org.hypercerts.claim.activity` |
| 20 | +- `org.hypercerts.claim.contribution` |
| 21 | +- `org.hypercerts.claim.contributorInformation` |
| 22 | +- `org.hypercerts.claim.rights` |
| 23 | +- `org.hypercerts.collection` |
| 24 | +- `org.hypercerts.context.acknowledgement` |
| 25 | +- `org.hypercerts.context.attachment` |
| 26 | +- `org.hypercerts.context.evaluation` |
| 27 | +- `org.hypercerts.context.measurement` |
| 28 | +- `org.hypercerts.funding.receipt` |
| 29 | +- `org.hypercerts.workscope.tag` |
| 30 | +- `org.hyperboards.board` |
| 31 | +- `org.hyperboards.displayProfile` |
| 32 | +- `app.certified.badge.award` |
| 33 | +- `app.certified.badge.definition` |
| 34 | +- `app.certified.badge.response` |
| 35 | +- `app.certified.actor.profile` |
| 36 | +- `app.certified.actor.organization` |
| 37 | +- `app.certified.location` |
| 38 | + |
| 39 | +**Design notes:** |
| 40 | + |
| 41 | +This is a non-breaking extension - signatures are optional on all records. Two signature patterns are supported: |
| 42 | + |
| 43 | +1. **Inline signatures** - Embedded directly in the record via `app.certified.signature.inline` |
| 44 | +2. **Remote attestations** - References to proof records in other repositories via `com.atproto.repo.strongRef` |
| 45 | + |
| 46 | +Signature algorithm identifiers use [JOSE format](https://www.iana.org/assignments/jose/jose.xhtml) per ATProto convention: |
| 47 | + |
| 48 | +- `ES256K` - secp256k1 (Ethereum/Bitcoin curve, ATProto default) |
| 49 | +- `ES256` - P-256 (NIST curve, WebCrypto compatible) |
| 50 | +- `Ed25519` - EdDSA |
0 commit comments