Don’t take our word for it. Check the record.
Every Plumbline audit and certification will come with a signed record, tied byte for byte to the files we audited. Drop it here and your browser checks who signed it, that nothing in it has changed, that it is still current, and that your copy of the task set is the one we audited. Nothing is uploaded.
Check a record
.attestation.json file
The whole set, or one task’s folder. Your browser reads the files and compares their SHA-256 fingerprints with the record. Files never leave your computer.
Key list: Plumbline’s published keys
By default the page uses the key list this site publishes at /.well-known/plumbline-keys.json. If you keep your own copy (recommended for anything you rely on), use it here.
Who issued it, and that nothing has changed.
A record is a small signed file in the format supply-chain security uses for software builds: an in-toto statement in a DSSE envelope, signed with Ed25519. Anyone can check it with open tools, without asking us.
A valid record proves
- Plumbline issued it, with a key listed in our published key list, valid on the day it was signed and not revoked
- Not one byte of it has changed since: the audit kind, dates, sample, results and the files covered
- Your files are exactly the ones audited, file by file and task by task, when you check a folder
- Whether it is still current or past its re-audit date
It does not prove
- That the audit was right. The published method, the run records and the reproduction kit are how you check that
- Anything about files it does not list, or about a later version of the task set
- Anything about a record signed with a DEMO key. Those are samples
Check it from the command line.
From November 10, our free scanner checks records from the command line too, on your machine, against the key list you choose. The task-set fingerprint needs nothing but standard tools today.
The fingerprint is the SHA-256 of one line per file, sorted: sha256 size path. Runs as is on Linux and macOS.
cd my-task-set
h() { if command -v sha256sum >/dev/null; then sha256sum; else shasum -a 256; fi; }
find . -type f ! -name .DS_Store | LC_ALL=C sort | while read -r f; do
printf '%s %s %s\n' "$(h < "$f" | cut -d' ' -f1)" "$(wc -c < "$f" | tr -d ' ')" "${f#./}"
done | h | cut -d' ' -f1No production record has been issued yet; the demo is signed with a key labeled DEMO.