Build Artifact Signing Tool for Provenance

WHAT IT DOES

Build Artifact Signing Tool for Provenance enables developers to cryptographically sign contract build artifacts (ABI, bytecode, metadata) using their Ethereum wallet, creating a verifiable provenance trail. The tool takes a JSON artifact containing contract name, ABI, and bytecode, computes its Keccak-256 hash, and signs that hash using the connected wallet's private key (or a specified address for external signing). The output includes the artifact hash, signer address, and the signature itself, packaged as a verification bundle. This allows anyone to later verify that a specific artifact was approved by a known address, establishing a chain of custody from build to deployment. The tool is read-only and does not submit anything to the blockchain—it only prepares data for off-chain provenance records.

HOW TO USE

Paste your contract artifact JSON (containing at minimum the ABI and bytecode; contract name and metadata are optional but recommended) into the input field. Choose the signing source: either your connected wallet (recommended) or a manual address for external signing. Click "Generate signature" to compute the artifact hash and produce a signature. The tool displays the artifact hash, signer address, signature, and a complete verification data block that can be saved alongside the artifact. Use the "Copy verification data" button to export the full bundle for storage in your repository or CI/CD pipeline. External verifiers can use the same artifact hash and signature to confirm the artifact was approved by the signing address.

TECHNICAL MECHANISM: ARTIFACT HASHING AND EIP-191 SIGNING

The tool computes a deterministic hash of the entire artifact JSON by serializing it with JSON.stringify (canonicalized to ensure reproducible hashing), converting to UTF-8 bytes, and applying Keccak-256. This hash represents the complete artifact content, including ABI and bytecode, ensuring any modification changes the hash. The signing process follows EIP-191 (Eth Signed Message) standard: the message is prefixed with "\x19Ethereum Signed Message:\n" + message length, then hashed and signed with the wallet's private key. This produces a recoverable signature from which the signer address can be derived using ecrecover, enabling anyone to verify the signature against the artifact hash. The tool uses ethers.js for all cryptographic operations, running entirely client-side, so the private key never leaves the wallet. The verification bundle includes all data necessary for third-party verification without requiring the original signing wallet.

WHAT IT CANNOT SEE

Cannot verify that the artifact matches the actual deployed bytecode on chain—it only signs what is provided, without any on-chain validation. Cannot verify the integrity of the build process that produced the artifact; it assumes the artifact is accurate. Cannot detect tampering with the artifact file prior to signing. Cannot ensure that the signing key is held securely; that depends on the user's wallet security. Cannot prove that the signer actually reviewed the artifact content; the signature only proves approval, not review. Cannot verify that the artifact was produced from a specific source commit without additional provenance data (e.g., Git commit hashes). Cannot detect that the artifact was modified after signing if the signature is detached—the hash must be recalculated against the original artifact. Cannot validate that the signer is authorized to sign on behalf of the project; it trusts the signing address. Cannot provide timestamped proof of signing without an external timestamping service.

PLEASE NOTE

EVM chains only. This tool does not interact with any blockchain, submit transactions, or store data on-chain. All signing is performed locally; no private keys are transmitted. The signature format is compatible with standard Ethereum signature verification libraries.