SIGNALLINK PUBLIC REPRODUCIBILITY CHALLENGE #1

Do not trust SignalLink. Reproduce the result yourself.

This challenge gives independent developers, integrators, auditors, researchers, and federal/prime technical teams a fixed public input and an exact expected SHA-256 result. A participant can use any language or toolchain.

ChallengeFederal Source-State SHA-256
Federal referenceNIST NVD · CVE-2021-44228
Expected resultDeterministic reproduction

EXPECTED SHA-256

b325608828a14df655f1b81d3a452cbd490292e6f3b5af6cae87bb4e1f0e8c77

Independent procedure

  1. Open the published JSON challenge vector.
  2. Use only the payload object as the test input.
  3. Recursively sort object keys lexicographically while preserving array order.
  4. Serialize as compact JSON with no extra whitespace.
  5. Compute SHA-256 over the UTF-8 canonical string.
  6. Compare the digest with the published expected value above.
  7. Post PASS or FAIL, your language/tool, canonical string, and computed digest in the open review issue.
Open test vectorPost independent resultInspect verifier
One-command reference reproduction

node scripts/reproduce-federal-challenge.mjs

The provided script is only a reference implementation. Stronger evidence comes from reproducing the result independently in another implementation or toolchain.

Evidence boundary

A PASS means an independent implementation reproduced the same deterministic canonical representation and SHA-256 digest from the same published input. It does not mean NIST, CISA, DoD, the U.S. Government, GitHub, Vercel, Sigstore, or another organization certified or endorsed SignalLink. The NIST NVD identifier is a federal-source reference used to exercise the provenance workflow; authoritative vulnerability facts remain with NIST/NVD.

Reproducible evidence should survive distrust.