Every PropRaven Quality Attestation PDF is Ed25519-signed and the content hash is published in a separate manifest. Three lines of bash and a public key prove the document on your screen is the one PropRaven generated — not something a salesperson edited on the way to your inbox. ← back to audit
Pick your stack. All three fetch the live attestation, recompute the SHA-256, and verify the signature. PASS exits 0; FAIL exits 1.
curl -sL https://propraven.com/audit/verify-attestation.sh | bash
curl -sL https://propraven.com/audit/verify-attestation.mjs | node --input-type=module
pip install --quiet cryptography requests curl -sL https://propraven.com/audit/verify-attestation.py | python3
Of course. The whole point of a verifiable artifact is you don't have to trust anything PropRaven hands you — including the verifier. Here are the manual steps:
# 1. Fetch the artifacts curl -O https://propraven.com/audit/sample.pdf curl -O https://propraven.com/audit/sample.json curl -O https://propraven.com/audit/attestation-public-key.b64 # 2. Hash the PDF and compare to manifest shasum -a 256 sample.pdf cat sample.json | jq -r .content_hash_sha256 # 3. Verify Ed25519 signature # (the canonical message that was signed is in sample.json:signature_message_canonical, # base64-encoded; the signature is in sample.json:signature_ed25519) # Wrap the raw 32-byte public key in DER SubjectPublicKeyInfo and verify # with openssl pkeyutl, or use any standard Ed25519 library.
SHA-256 of sample.pdf bytes must equal thecontent_hash_sha256 field in sample.json. A single-byte tamper changes the hash.
Length of the PDF must equal content_bytes in the manifest. Belt-and-suspenders against truncation.
The signature in signature_ed25519 must verify against signature_message_canonical using the published public key at /audit/attestation-public-key.b64. The canonical message is a deterministic JSON encoding of the manifest minus the signature itself.
The private key lives in Vercel's encrypted env-var store and is rotated on a quarterly schedule alongside each new attestation. Rotation events publish a fresh public key at the same URL — older attestations remain verifiable as long as the prior public keys are archived (we publish historical keys at /audit/attestation-public-key.b64?v=YYYY-Qx when we rotate). If you are auditing a historical attestation, fetch the matching key for that quarter.
Today's key is the original v1 key, generated 2026-05-02. No rotation has occurred yet.