# signtree — Changelog

## v1.0.0 — 2026-06-25

Initial release. Eighth tool in the "productivity-boost" series.

### Purpose

Detached Ed25519 signature verifier. Three formats:
1. **signify** (OpenBSD) — the `.sig` neighbour that ships with every
   cli.johlem.net release binary.
2. **minisign** (Frank Denis) — same wire format as signify but with a
   `trusted comment:` line and a global signature for the comment.
3. **shellrec / jfind-like** — one-line JSON blob with embedded
   `pubkey_hex`, `sig_hex`, `sha256_hex`. Used by `shellrec sign`.

For signify / minisign you need a public-key file (`--pub-key`); for
jfind-like the pubkey is embedded.

### Subcommands

```
signtree verify <file> [--sig <sigfile>] [--pub-key <pubfile>]
signtree walk   <dir>  [--pub-key <pubfile>]
signtree info   <sigfile>
signtree list-formats
```

`verify` auto-detects `<file>.sig` or `<file>.minisig` if `--sig` is
omitted. `walk` recurses a directory and reports on every file that
has a signature neighbour.

### jfind/v1 output

| Verdict | Category | Severity |
|---|---|---|
| `Verified`     | `asset-inventory`  | Info |
| `Failed`       | `policy-violation` | High |
| `NoSignature`  | `policy-violation` | Medium |
| `NoPubkey`     | `policy-violation` | Medium |

Controls: DORA Art. 9 + Art. 28 + NIS2 Art. 21(2)(j) + ISO/IEC
27001:2022 A.8.26 (application security — verified releases).

### Exit codes

```
0  ok (every file verified)
2  usage
3  runtime (parse error, unknown format)
4  one or more verdicts were not `verified`
```

### Build

- Library crate + thin CLI binary.
- 2 unit + 10 integration tests, all green.
- Zero compiler warnings.
- Ed25519 via `ed25519-dalek 2`.
- SHA-256 via `sha2 0.10`.
- Offline. No network.

### Deferred to v1.1

- Cosign blob verification (X.509 cert chain + transparency log).
- Sigstore Rekor inclusion proofs.
- Hierarchical key registries (today: one `--pub-key` per invocation).
- Per-file remediation hints in walk output.