Check the package without asking us.
An Attestkeep evidence package is signed inside your client's cluster. The format, the key and the steps to verify it are public, so the answer does not depend on us being reachable.
One zip, six files.
The report is the evidence. Everything else covers it, vouches for the key that signed it, or renders it for people.
report.jsonThe report, byte for byte as it was signed. This is the file to check.attestation.jsonA DSSE envelope carrying an in-toto statement whose subject is the report's digest.certificate.jwtThe licence certificate, signed by Attestkeep, naming the installation and the key it signs with. Absent if the installation was not activated; the signature still proves the report is unaltered.<report-id>.pdfA rendering for reading. Checking the PDF is not checking the evidence.<report-id>.attestkeep.jsonThe report, attestation and certificate in one file, for the browser verifier.README.txtWhat each file is and how to check it, written for someone who has never heard of us.
Three ways, none of them through us.
In the browser
Drop the zip on attestkeep.com/verify.html. The root key is built into the page and nothing is uploaded; you can disconnect after it loads and get the same answer.
With a short script
The documentation site has the whole check in a page of Python, standard library plus one crypto package. Verifying a report
With your own tools
DSSE and in-toto are public specifications, and the predicate is documented field by field. Evidence format
Two things, and it is precise about both.
- It provesThe report has not changed since it was signed, and it was signed by a key Attestkeep vouched for as belonging to that installation.
- It does not proveWhen it was signed: timestamps come from the installation's own clock. Nor that the events it describes happened as described.
- It is notA legal electronic signature, or a certification. No auditor is obliged to accept it.
- An expired certificateIs reported, not rejected. Certificates rotate every thirty days; the report is from the period they covered.
- Four statesMet, partial, gap or outside scope. Partial and gap are printed, not hidden.
- The instrument's wordsEach clause restates what it asks close to the original text, so you check the claim against the standard rather than against a feature name.
- Numbers behind each noteThe note gives the period's figures and names the report sections they come from.
- Scope stated up frontEach framework's report opens with what one cluster's records can and cannot support.
Auditing a client that runs Attestkeep?
Ask us anything about the format or the checks. Working with several clients? See the partner programme.
Talk to us