Format of 0xPUBKEY_COMRESSED_HEX.json in gist github proof

[javaspeak]

In https://github.com/NextDotID/proof_server#supported docs I see:

Github	github	github_username	Public visible Gist ID a6dddd2811af21b671fd	Gist should contain 0xPUBKEY_COMRESSED_HEX.json file

Regarding the json file which is pushed to the gist github repository:

1. Does it have the hex public key in the name and the file is empty
2. or is the filename exactly "0xPUBKEY_COMRESSED_HEX.json" and the contents of the file has the hex public key?
3. or the file has the hex public key in the name and it is also in the file?

[nykma]

Here is a sample of the Gist:

https://gist.github.com/nykma/5b3acc09d25242950e4b7ea0ee707ada

[javaspeak]

If I understand correctly the file in the gist repository is:

0x03947957e8a8785b6520b96c1c0d70ae9cf59835eec18f9ac920bbf5733413366a.json

and the name of the file is the public key which was got as follows:

(i) Call /v1/proof/payload and get its response. That response goes into the above json file
(ii) Get sign_payload from the response
(ii) Sign the contents of sign_payload with the wallet that created the avatar
(iii) Hash the same contents
(iv) Pass both the signature and the hash to a method which recovers the public key
(v) Convert public key to base64 and use it in the json file name

Is that correct?

Another thing I do not understand why your sample link has 2 json files in it?

[nykma]

If I understand correctly the file in the gist repository is:

0x03947957e8a8785b6520b96c1c0d70ae9cf59835eec18f9ac920bbf5733413366a.json

Correct but not precise. In fact Gist can contain multiple files, you just need to make sure one of the file is named as 0xCOMPRESSED_PUBLIC_KEY_HEX.json . In my sample, there are 2 proof files signed by different Avatars.

I'll give suggestions for your steps one by one:

1. Correct
2. Correct
3. Sign sign_payload using the Avatar secret key (which may be in MetaMask or other wallet contanier)
4. What do you mean by hash ? You should base64() the signature and replace %SIG_BASE64% in ['post_content']['default'] field in POST /v1/proof/payload response
5. Let user create a gist and post the base64-replaced content as 0xCOMPRESSED_PUBLIC_KEY_HEX.json filename
6. Guide user to give you back the gist ID (in the URL, like 5b3acc09d25242950e4b7ea0ee707ada in https://gist.github.com/nykma/5b3acc09d25242950e4b7ea0ee707ada

[javaspeak]

Re 4: "What do you mean by hash ?" In order to recover the public key from a wallet one needs code like this:

    import {hashMessage, recoverPublicKey } from 'viem'

    const signature = await signMessage({ message: message });
    const messageHash = hashMessage(message);
    
    const publicKey = await recoverPublicKey({
      hash: messageHash,
      signature: signature
    })

So when dealing with wallets one needs to create the hash in order to recover the public key.