Check a certificate

# Keep the copy: it is the certificate's exact text.
curl -s https://campaign.udao.org/api/public/credentials/80757f30-0e4f-5db4-ab92-9d5245dfb9fd/document -o exact-text.json
wc -c < exact-text.json | tr -d ' '
# keccak-256 needs OpenSSL 3.2 or later. It is not SHA3-256: never -sha3-256.
openssl dgst -keccak-256 -r exact-text.json | cut -c1-64 | sed 's/^/0x/'

// check-signature.mjs, Node 18 or later: nothing to install.
import { createHash, createPublicKey, verify } from "node:crypto";

const record = await (await fetch("https://campaign.udao.org/api/public/credentials/80757f30-0e4f-5db4-ab92-9d5245dfb9fd/verify")).json();
const key = await (await fetch("https://campaign.udao.org/api/public/credentials/signing-key")).json();

// RFC 8785: keys sorted, no spaces.
const jcs = (v) => v === null || typeof v !== "object" ? JSON.stringify(v)
  : Array.isArray(v) ? "[" + v.map(jcs).join(",") + "]"
  : "{" + Object.keys(v).sort().map((k) => JSON.stringify(k) + ":" + jcs(v[k])).join(",") + "}";
const sha256 = (v) => createHash("sha256").update(jcs(v)).digest();
const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
const base58 = (text) => {
  let n = 0n;
  for (const c of text) n = n * 58n + BigInt(ALPHABET.indexOf(c));
  const hex = n.toString(16);
  const zeros = text.length - text.replace(/^1+/, "").length;
  return Buffer.concat([Buffer.alloc(zeros), Buffer.from(hex.length % 2 ? "0" + hex : hex, "hex")]);
};

// eddsa-jcs-2022: Ed25519 over the 2 digests, the proof's options first.
const { proof: proofs, ...document } = record;
const { proofValue, ...options } = proofs.find((one) => one.cryptosuite === "eddsa-jcs-2022");
const raw = base58(key.publicKeyMultibase.slice(1)).subarray(2); // after 0xed01
const spki = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]);
const publicKey = createPublicKey({ key: spki, format: "der", type: "spki" });
// The key is the issuer's: its controller is the record's issuer.
const valid = options.verificationMethod === key.id && key.controller === record.issuer.id
  && verify(null, Buffer.concat([sha256(options), sha256(document)]), publicKey, base58(proofValue.slice(1)));
console.log(valid ? "valid" : "INVALID");
// Its status is an entry on the revocation list: the next check reads it.
console.log(record.credentialStatus.type);

// check-status.mjs, Node 18 or later: npm install jsonld
import { createHash, createPublicKey, verify } from "node:crypto";
import { gunzipSync } from "node:zlib";
import jsonld from "jsonld";

const record = await (await fetch("https://campaign.udao.org/api/public/credentials/80757f30-0e4f-5db4-ab92-9d5245dfb9fd/verify")).json();
const entry = record.credentialStatus;
const ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
const base58 = (text) => {
  let n = 0n;
  for (const c of text) n = n * 58n + BigInt(ALPHABET.indexOf(c));
  const hex = n.toString(16);
  const zeros = text.length - text.replace(/^1+/, "").length;
  return Buffer.concat([Buffer.alloc(zeros), Buffer.from(hex.length % 2 ? "0" + hex : hex, "hex")]);
};
// RDF Dataset Canonicalization, the eddsa-rdfc-2022 suite's.
const nquads = (doc) => jsonld.canonize(doc, { algorithm: "RDFC-1.0", format: "application/n-quads", safe: true });
const sha256 = (text) => createHash("sha256").update(text).digest();

let status = "status unknown"; // until every check below passes
try {
  const list = await (await fetch(entry.statusListCredential)).json();
  // The published key, as in step 1: never the one the list names.
  const key = await (await fetch("https://campaign.udao.org/api/public/credentials/signing-key")).json();
  const now = new Date();
  const { proof, ...unsecured } = list;
  const { proofValue, ...options } = proof;
  const raw = base58(key.publicKeyMultibase.slice(1)).subarray(2); // after 0xed01
  const spki = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]);
  const publicKey = createPublicKey({ key: spki, format: "der", type: "spki" });
  const data = Buffer.concat([
    sha256(await nquads({ "@context": unsecured["@context"], ...options })),
    sha256(await nquads(unsecured)),
  ]);
  // Signed with the record's key, by its issuer, at its issuer's address;
  // the list's type, purpose and dates; its proof.
  const valid = key.id === proof.verificationMethod && key.controller === record.issuer.id
    && list.issuer.id === record.issuer.id && entry.statusListCredential.startsWith(record.issuer.id)
    && proof.cryptosuite === "eddsa-rdfc-2022"
    && list.type.includes("BitstringStatusListCredential")
    && list.credentialSubject.statusPurpose === "revocation"
    && new Date(list.validFrom) <= now && now <= new Date(list.validUntil)
    && verify(null, data, publicKey, base58(proofValue.slice(1)));
  console.log(valid ? "valid" : "INVALID");
  // Drop the u, decode base64url, gunzip: at least 131,072 bits.
  const bits = gunzipSync(Buffer.from(list.credentialSubject.encodedList.slice(1), "base64url"));
  console.log(bits.length * 8);
  if (valid && bits.length * 8 >= 131072) {
    // The left-most bit is 0. A 1 is revoked.
    const index = Number(entry.statusListIndex);
    const bit = (bits[Math.floor(index / 8)] >> (7 - (index % 8))) & 1;
    status = bit === 1 ? "revoked" : "not revoked";
  }
} catch {}
console.log(status);