Verify an evidence pack

Every Domain Posture evidence pack ships with a manifest that names its files by SHA-256 and is signed with our Ed25519 key. Enter the report id and we'll check that signature server-side, then show you what it does — and does not — prove.

The report id is the UUID printed in the footer of every page of pack.pdf, and is the scanJobId field inside manifest.json.

Verify offline instead

You do not have to trust this page. The signing key is published, and the verifier is a dependency-free Node script — run both against your own copy of the pack, on a machine we never touch:

# from the directory containing pack.pdf, pack.json, manifest.json, manifest.sig
curl -O https://domainposture.com/scripts/verify-pack.mjs
curl -O https://domainposture.com/.well-known/evidence-pack-pubkey.pem
node verify-pack.mjs --dir .

public key (PEM) — the Ed25519 key every pack is signed with
verify-pack.mjs — self-contained verifier, Node 20+, no dependencies
methodology v1 — the signing scheme, and the OpenSSL-only equivalent