verify a record yourself
every record on this site is signed, and you can check that signature yourself using the public key we publish alongside it. a valid signature tells you the record hasn't been altered since we signed it; it doesn't tell you anything about whether the software itself is safe or behaves as described.
the command
from any release's raw-evidence table, download ledger-entry.json, ledger-entry.json.minisig, and the pinned key file named on /keys/. then run:
minisign -Vm ledger-entry.json -p solpbc-transparency-1.pub -x ledger-entry.json.minisig
reading the result
| outcome | what it means |
|---|---|
| signature verifies | the signature checks out. this exact record matches what we signed and hasn't been altered. |
| signature fails to verify | the signature doesn't check out. don't trust this copy, and let us know how you got it. |
| curl or fetch fails | we couldn't complete the check, usually a network or availability issue on our end; that's different from a failed check and isn't evidence the record is wrong. |