Docs · preview

Verification

enruta-verify is a single-file, dependency-free program, Apache-2.0, shipped inside every export. It needs no network and no Enruta account.

What it checks

Canonical form. Re-canonicalizes the record (RFC 8785) and confirms the bytes are canonical.
Seal. Recomputes SHA-256 over the canonical bytes and compares it with seal.hash and the record id.
Chain. Confirms seal.prev matches the previous record when it is present in the same export, and reports a gap otherwise.
Attestations. Validates each RFC 3161 token against the snapshotted authority certificates, checks the daily-root inclusion proof and the root’s signature, and verifies the OpenTimestamps anchor when a proof is present.
Keys. Confirms every key referenced in keys is in the bundle with a provenance tag, and that signatures over the approval and the policy verify under those keys.
Strength. Reports the record’s own strength labels. It never upgrades a self-asserted claim.

Running it

npx enruta-verify rec_01J9….json            # one record, bundle found alongside
npx enruta-verify ./export-2026-11/        # a whole export, chain checked end to end
npx enruta-verify rec_01J9….json --json    # machine-readable report

Exit code	Meaning
`0`	PASS: every check passed
`1`	FAIL: at least one check failed; the report names it
`2`	Could not verify: missing bundle or unreadable input; nothing is claimed either way

What FAIL looks like

# seal             FAIL  hash mismatch: record bytes were modified after sealing
# chain            ok
# attestations     ok
# FAIL (1 of 6 checks failed)

A back-dated record fails on attestations: the time-stamp tokens prove the seal existed no earlier than the authority said, and a created_at before that is reported.

Reproducing it

The schema, the canonicalization rules, the test vectors (valid, tampered, back-dated, chain gap) and the verifier source are published together. Anyone can write another verifier and check it against the vectors.

← Evidence Record schema API →