Mooncred Apache-2.0 0.6.4

Credentials,
read and written.

Thirteen packages for the credentials a system must trust and the ones it must present — a certificate, a key, a request, a container, a revocation list, a token, a sealed envelope of JSON. They read what other tools write, and write what other tools read.

Nothing here picks an algorithm, invents a random number, or opens a socket.

$ moon add moonbitstack/mooncred 13 packages · four targets

Mooncred the register ii

The shelf.

Each package names its specification and stops there. A format that arrives without one is not on the list.

x509certificates, chains, names, extensions5280 · 6125

pkcs12a key and its chain in one file7292

csrthe request made before a certificate2986

jwtsigned claims, thirteen algorithms7515 · 7519

jwkkeys as JSON, and sets of them7517

jweclaims nobody else may read7516

cosesign, mac and encrypt, over CBOR9052

cborthe encoding COSE is written in8949

pbekeys kept behind a passphrase8018 · 5958

revokelists and answers, read and judged5280 §5 · 6960

policywhether a chain suits a purpose5280 §6.1

tokena payload, a stamp, an HMAC—

rootsthe Mozilla store as anchors—

Mooncred evidence iii

Verified, not claimed.

Every fixture in the suite was written by openssl, so each reader is measured against a writer it did not write.

openssl req -verify A request written here prints self-signature verify OK.

openssl pkcs12 -info Our container opens; a wrong passphrase gives Mac verify error — the negative case, proved too.

openssl pkeyutl -decrypt Both directions: a key wrapped here by RSA-OAEP-256 opens in openssl, and the reverse.

moon test --target all 137 tests pass on wasm-gc, js, native and wasm.

The revocation fixtures come from the same script: good, revoked, unknown and expired are each a case the reader has to get right, and a stale list is a case it has to refuse.

13packages

137tests

4backends

0sockets

Mooncred what it will not do iv

Four refusals.

It chooses no algorithm.

The verifier is told which one to expect. A token that names its own is refused, because that is how a signature gets swapped.

It generates no entropy.

Salt, IV and content key are arguments. A test can then assert on a byte string instead of hoping.

It opens no socket.

revoke reads a list and judges an answer. Fetching either is the caller's business.

It implements no primitive.

RSA, ECDSA, Ed25519 and AES come from mooncrypt. ML-DSA certificates wait for it, rather than being faked here.

Sealed and kept, 0.6.7.github.com/moonbitstack/mooncred

Credentials,read and written.