Verify the SDK from source

The Privatemode JavaScript / TypeScript SDK is open source and can be built reproducibly. This allows you to verify that the JavaScript, type declarations, and Wasm module in the published npm package match the published source code.

Prerequisites

• Nix (we recommend the Determinate Systems Nix installer)
• Node.js and npm if you want to compare the build with the published package

Build from source

Clone the public source code at the tag corresponding to the SDK version you want to verify:

git clone --branch <tag> https://github.com/edgelesssys/privatemode-public
cd privatemode-public

Build the SDK with Nix:

nix build .#sdk.js -L

The NPM package is available in ./result/share, with the distributable SDK files in ./result/share/dist.

Compare with the published package

Download and extract the corresponding npm package, replacing <version> with the SDK version you want to verify:

package_archive=$(npm pack --silent "privatemode-ai@<version>")
mkdir published-sdk
tar -xzf "${package_archive}" -C published-sdk

Compare the published dist directory with the local build:

diff -r result/share/dist published-sdk/package/dist

The command produces no output and exits successfully if the files match.