bullet: integrated work for human review #15

Merged

EduarD3V merged 13 commits from bullet-develop into main

2026-10-14 12:42:47 +02:00

EduarD3V commented

2026-10-14 12:26:02 +02:00

Owner

Rolling PR. All bullet work lands on bullet-develop via per-issue PRs (auto-merged after review + gates). Merge this single PR into main when satisfied.

Integrated issues:

PR #16 — Use case: verify signatures (upload -> validity report)
PR #17 — Use case: CAdES sign in browser (detached, SHA-256)

Automated by bullet: implemented → reviewed (independent model) → gates green → auto-merged into bullet-develop. Trunk is human territory; this PR is the one button the human presses.

**Rolling PR.** All bullet work lands on `bullet-develop` via per-issue PRs (auto-merged after review + gates). Merge this single PR into `main` when satisfied. Integrated issues: - PR #16 — Use case: verify signatures (upload -> validity report) - PR #17 — Use case: CAdES sign in browser (detached, SHA-256) Automated by bullet: implemented → reviewed (independent model) → gates green → auto-merged into bullet-develop. Trunk is human territory; this PR is the one button the human presses.

EduarD3V added 12 commits

2026-10-14 12:33:03 +02:00

web: parse PKCS#12 and import the signing key with WebCrypto (Refs #5 ) db4a0ac33e

web: load PKCS#12 in the picker UI and enable signing (Refs #5 ) ac5afe2479

web: type byte buffers as ArrayBuffer-backed for WebCrypto/BufferSource (Refs #5 ) 9e1dbbb048

review: clear stale cert list when keystore file changes (Refs #5 ) 27d86a55f3

web: canonicalize XML in TypeScript (C14N 1.0 + exclusive) (Refs #7 ) e2004738ec

web: XAdES-EPES enveloped signature with WebCrypto and own c14n (Refs #7 ) 5d80a63348

web: type the XAdES test helpers for svelte-check (Refs #7 ) 140875255e

web: sign XAdES from the UI and download the .xsig (Refs #7 ) 2a8f672b8e

docs: document the XAdES engine and its xmlsec1 check (Refs #7 ) b21152a897

web: verify the UI-produced .xsig with xmlsec1 (Refs #7 ) 07be7ed88f

review: digest and keep document-level PIs and comments in the .xsig (Refs #7 ) 13e6c4e780

signXades dropped top-level PIs and comments from the output and
canonicalize(doc) ignored them, so a document with e.g. an xml-stylesheet
PI was signed altered. Document node-sets now emit PIs/comments separated
by the newline xmllint, lxml and xmlsec1 emit, and the .xsig serializes
every document child. Verified against xmlsec1 for PI+comment, lone
comment, and comment-before-PI documents.

Merge remote-tracking branch 'origin/issue/7-use-case-xades-sign-in-browser' into bullet-develop 41af16a502

EduarD3V merged commit 890e564afa into main

2026-10-14 12:42:47 +02:00

EduarD3V referenced this pull request from a commit

2026-10-14 12:42:49 +02:00

Merge pull request 'bullet: integrated work for human review' (#15) from bullet-develop into main

~~EduarD3V referenced this pull request 2026-10-14 16:06:16 +02:00~~

Epic: MCP server exposing AutoFirma sign/verify to agents (study) #28