Verify ZENITH signed artefacts offline

// Node.js — verify a ZENITH signed artefact offline
import { ed25519 } from '@noble/curves/ed25519';
import { sha256 } from '@noble/hashes/sha256';
import canonicalize from 'canonicalize'; // RFC 8785 JSON canonicalization scheme

// 1. Fetch + parse did.json (once, cached)
const did = await (
  await fetch('https://zenith-os.bostraion.com/.well-known/did.json')
).json();
const publicKeyMultibase = did.verificationMethod[0].publicKeyMultibase;
const publicKey = decodeMultibase(publicKeyMultibase); // strip 'z' + base58btc decode + multicodec prefix

// 2. Canonicalise the bundle (byte-for-byte stable)
const canonical = canonicalize(bundleWithoutSignature); // RFC 8785
const digest = sha256(new TextEncoder().encode(canonical));

// 3. Verify the signature
const ok = ed25519.verify(
  Buffer.from(signatureHex, 'hex'),
  digest,
  publicKey,
);
console.log(ok ? 'VALID' : 'INVALID');

# Python — verify a ZENITH signed artefact offline
import json, base58, requests, hashlib
from nacl.signing import VerifyKey

# 1. Fetch did.json
did = requests.get(
    'https://zenith-os.bostraion.com/.well-known/did.json'
).json()
multibase = did['verificationMethod'][0]['publicKeyMultibase']
# strip 'z' prefix, base58btc decode, skip 2-byte multicodec header
raw = base58.b58decode(multibase[1:])[2:]
vk = VerifyKey(raw)

# 2. Canonicalise (sorted keys, no whitespace) — matches sha256CanonicalJsonHex
canonical = json.dumps(bundle_without_signature, sort_keys=True, separators=(',', ':'))
digest = hashlib.sha256(canonical.encode()).hexdigest()

# 3. Verify
try:
    vk.verify(bytes.fromhex(digest), bytes.fromhex(signature_hex))
    print('VALID')
except Exception:
    print('INVALID')