Signatures & Integrity

What integrity verification proves

Verification answers one question:

“Do these bytes match the data signed by the published key?”

• If yes → the snapshot is authentic and unchanged
• If no → the data must not be trusted

Integrity does not imply quality, safety, compliance, or endorsement.

Public verification artifacts

Every snapshot publishes three immutable files:

• /index/index.json — snapshot data
• /index/index.sig — detached Ed25519 signature (base64)
• /index/index.pub — public key (PEM)

These files can be mirrored, cached, archived, and verified on any machine.

Step-by-step verification (Node.js)

Requires Node.js ≥ 18. No ETHORITY software or account required.

// verify.mjs
import fs from "fs";
import crypto from "crypto";

const data = fs.readFileSync("index.json");
const sig = Buffer.from(
  fs.readFileSync("index.sig", "utf8").trim(),
  "base64"
);
const pub = fs.readFileSync("index.pub");

const ok = crypto.verify(
  null,
  data,
  { key: pub, format: "pem", type: "spki" },
  sig
);

console.log(ok ? "VERIFIED" : "INVALID");

Any modification to index.json — even one byte — causes verification to fail.

Tamper detection model

Integrity verification is meaningful only if tampering is detectable.

Altering snapshot content causes verification to return INVALID. Re-downloading the original snapshot restores VERIFIED.

Use case snapshot

A journalist cites a snapshot hash. An auditor verifies integrity years later. An autonomous agent refuses unsigned data. None rely on ETHORITY’s UI.