Conformance test service for the AAuth family of specifications, to be served
at conformance.aauth.dev.
It exists to test the things static test vectors cannot.
Test vectors live with the specifications they belong to — for Signature-Key that is dickhardt/signature-key#25, which proposes an appendix of vectors plus a machine-readable copy in the repo. Those are the durable artifacts: they version with the draft, survive into the RFC, and let an implementation test itself with no network.
Two things they cannot do.
Discovery schemes need a real endpoint. The jwks_uri, jwks, and
self-jwt schemes resolve a URL. Today implementations test them against a
mocked fetch, which cannot catch an HTTP, TLS, redirect, or CORS problem.
A static vector cannot test a signer. A published signature proves your verifier agrees with it. Nothing static proves your signer produces something others accept — and for randomized algorithms (ECDSA, RSA-PSS, and ML-DSA in its default hedged mode) a reproduce-the-bytes vector is not even constructible, so the signer side is untestable without a live peer.
This service is that peer, available without arranging a bilateral test with another implementer.
- Live discovery endpoints:
.well-knownmetadata and JWKS, including a JWKS carrying an ML-DSA-44 key alongside a classical one - A verifier endpoint: point your signer at it, get a structured verdict
- A signer endpoint: fetch correctly signed requests to test your verifier
Nothing here is normative. The specifications never cite these URLs — URLs rot, and a document that depends on one ages badly.
Not built. See the issues.