SDK 0.6.0: offline and air-gapped verification

SDK 0.6.0 ships today for both Python (asqav) and TypeScript (@asqav/sdk). The main addition is a clean offline verification path for environments that cannot reach the internet during an audit run.

The idea is simple: fetch the public key directory once while you are connected, then everything else is local. No special mode, no API key, no Asqav infrastructure involved during the verify step.

Offline verification in one pass

# snapshot the public key directory once
curl https://api.asqav.com/.well-known/jwks.json > jwks.json

# install the verify dependencies
pip install "asqav[verify]"

# verify with no network access
python verify_receipt.py \
    --receipt receipt.json \
    --jwks jwks.json \
    --offline

The --offline flag makes the verifier refuse to make any network call. If a key is missing from your local snapshot, the issuer-key axis fails rather than fetching silently.

ML-DSA-65 works the same way

Post-quantum receipts (ML-DSA-65, NIST FIPS 204) verify offline the same way as Ed25519 receipts. The algorithm identifier rides inside the signed envelope, so the verifier reads which algorithm to use from the receipt itself. The pure-Python dilithium-py library handles the signature math with no native compilation.

Air-gapped installs

If the target machine has no internet at all, pre-download the wheels on a connected machine and transfer them:

pip download "asqav[verify]" -d ./wheels
# transfer ./wheels/ to the air-gapped machine
pip install --no-index --find-links ./wheels "asqav[verify]"

Getting started

Full offline verification guide: asqav.com/docs/offline-air-gapped-verification. Source: github.com/jagmarques/asqav-sdk.