← Home

Release Attestations

dogfood · slice 3 · sealed with our own organ

Every release artifact we have published is sealed below by the same organ that seals our own pages: the envelope carries its Ed25519 public key, so a verifier needs the envelope and nothing else — no issuer, no key directory, no network call. Download the artifact from its registry, hash it, and check the seal: if the hash matches the envelope’s subject and the signature verifies, this file is byte for byte what our organ attested.

Verify all six, offline, in one command (re-downloads each artifact from its registry, recomputes the hash, and checks the Ed25519 envelope — the seals are archived, so freshness checking is off, per the package’s archival mode):

pip install "iqa-org[ed25519]==1.2.8"
python -c "import json,urllib.request,hashlib,iqa.attest as A
d=json.load(urllib.request.urlopen('https://iqa.org/attestations/release-attestations.json'))
for a in d['attestations']:
    b=urllib.request.urlopen(urllib.request.Request(a['url'],headers={'User-Agent':'verify/1'})).read()
    s=hashlib.sha256(b).hexdigest()
    print(a['package'], a['registry'], A.verify_attestation(a['envelope'],'iqa://'+s[:32]+'.forge.iqa',check_freshness=False)[:2], s[:16])"

Caught on release day: the verify command above originally omitted the [ed25519] extra — found by our own first faithful reading of the page (the dogfood doing its job) and fixed the same day. External readers who find anything similar: the challenge rule applies — a faithful reading that fails is our bug, fixed and credited by name.

Organ AID: ba92fadd46a51caf25633e0f315c4ad10103b879d7397397362f89dc33817153 · envelope version 1 · the seal bundle lives at /attestations/release-attestations.json · canonical copy: iqa.org/attestations/.

The organ also answers live at /organ-api/v1/production (list all production seals; add ?subject=<32-hex> for one envelope) — the same seven-day-a-week endpoint that back this page.