Releases and signatures

curl -fsS "https://api.octroi.app/tax-data/v1/signing-key" -o signing-key.pem

function pemToDer(pem: string): Uint8Array<ArrayBuffer> {
  const base64 = pem
    .replace(/-----(BEGIN|END) PUBLIC KEY-----/g, "")
    .replace(/\s+/g, "");
  return Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
}

export async function verifyManifest(
  manifest: Uint8Array<ArrayBuffer>,
  signature: Uint8Array<ArrayBuffer>,
  publicKeyPem: string,
): Promise<boolean> {
  const key = await crypto.subtle.importKey(
    "spki",
    pemToDer(publicKeyPem),
    { name: "Ed25519" },
    false,
    ["verify"],
  );
  return crypto.subtle.verify({ name: "Ed25519" }, key, signature, manifest);
}

export async function sha256Hex(bytes: Uint8Array<ArrayBuffer>): Promise<string> {
  const digest = await crypto.subtle.digest("SHA-256", bytes);
  return [...new Uint8Array(digest)]
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

import { createPublicKey, verify } from "node:crypto";
import { readFileSync } from "node:fs";

const dir = "./releases/2026-10-11";
const manifest = readFileSync(`${dir}/manifest.json`);
const signature = readFileSync(`${dir}/manifest.json.sig`);
const key = createPublicKey(readFileSync("./signing-key.pem", "utf8"));

if (!verify(null, manifest, key, signature))
  throw new Error("manifest.json is not signed by this key");

import { readFile } from "node:fs/promises";
import { manifestSchema } from "./calculator";
import { sha256Hex } from "./verify";

const dir = "./releases/2026-10-11";
const manifestBytes = new Uint8Array(await readFile(`${dir}/manifest.json`));
const manifest = manifestSchema.parse(
  JSON.parse(new TextDecoder().decode(manifestBytes)),
);
const files = [
  ...manifest.countries.flatMap(({ file, vectors }) => [file, vectors]),
  manifest.changes,
  manifest.changelog,
  manifest.license,
  ...manifest.schemas,
];
for (const { path, sha256 } of files) {
  const bytes = new Uint8Array(await readFile(`${dir}/${path}`));
  if ((await sha256Hex(bytes)) !== sha256)
    throw new Error(`${path} does not match the manifest`);
}

import { readFile } from "node:fs/promises";
import { isDeepStrictEqual } from "node:util";
import {
  type Place,
  type QuoteRequest,
  quote,
  quoteVectorOf,
  resolve,
  resolveVectorOf,
  TaxDataError,
  vectorFileSchema,
} from "./calculator";
import { loadRelease } from "./load";

const dir = "./releases/2026-10-11";
const release = await loadRelease(dir, ["es"]);
const file = vectorFileSchema.parse(
  JSON.parse(await readFile(`${dir}/vectors/es.json`, "utf8")),
);

let failed = 0;
for (const vector of file.vectors) {
  // quote and resolve parse their own input; an error vector's request is unchecked on purpose.
  const run = () => {
    if (vector.fn === "quote")
      return quoteVectorOf(quote(release, vector.request as QuoteRequest));
    const { place, on } = vector.request as { place: Place; on: string };
    return resolveVectorOf(resolve(release, place, on));
  };
  let ok: boolean;
  if ("error" in vector) {
    try {
      run();
      ok = false;
    } catch (error) {
      ok = error instanceof TaxDataError && error.code === vector.error.code;
    }
  } else ok = isDeepStrictEqual(run(), vector.response);
  if (!ok) {
    failed++;
    console.error(`${file.country} ${vector.name} differs`);
  }
}
console.log(`${file.vectors.length - failed} of ${file.vectors.length} passed`);