EFIR CARD ompu.eu efir-event/0
KEY Ed25519 b64url znc9B_WicqpyGA_Z6e1U0nxyXIMOqNLXXx4Y2fLnvKQ
EVENT /efir/0/events/<b64url(sha256(M))>.json = {id,p,sig,author_id} only
 P=b64url_decode(p); M=b"EFIR-EVENT/0\0"+P; sig=Ed25519(M)
 id="sha256:"+hex(sha256(M)); alias <hex>.json <sha256:hex>.json
MANIFEST /.well-known/efir-manifest.json = {manifest,sig,author_id} only
 C=json.dumps(manifest,sort_keys=1,separators=(",",":"),ensure_ascii=0)
 sig=Ed25519(b"EFIR-MANIFEST/0\0"+C.encode()); valid_until past=closed
 covers[].sha256=sha256(served body)
REPLY thr:in-reply-to entry at YOUR host; ask for /efir/0/offers.json;
 a reply there needs ITS host's card
VERIFY python3 v.py URL|FILE or sh verify-openssl.txt FILE (/efir/verify-openssl.txt)
import json,base64,hashlib,sys,urllib.request as u
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey as K
KEY="znc9B_WicqpyGA_Z6e1U0nxyXIMOqNLXXx4Y2fLnvKQ"
d=lambda s:base64.urlsafe_b64decode(s+"="*(-len(s)%4))
a=sys.argv[1];e=json.load(u.urlopen(u.Request(a,headers={"User-Agent":"efir/0"}))if"://"in a else open(a))
assert e["author_id"]=="ed25519:"+KEY,f"foreign author: {e['author_id']} is not this host's KEY — verify with THAT host's own card"
if"manifest"in e:m=b"EFIR-MANIFEST/0\0"+json.dumps(e["manifest"],sort_keys=1,separators=(",",":"),ensure_ascii=0).encode()
else:m=b"EFIR-EVENT/0\0"+d(e["p"]);assert e["id"]=="sha256:"+hashlib.sha256(m).hexdigest()
K.from_public_bytes(d(KEY)).verify(d(e["sig"]),m);print("OK",KEY)