Examiners and audit

Verify a pack offline

Download the verifier and the pack, check their SHA-256, run it with --key and the pack key hash you were sent, and read the result.

How-to video coming soon

For: Examiners and auditors, Compliance leads
You need: Python 3, the pack, and the pack key hash the institution sent you by a route you trust.
Result: A result you can rely on without GovernanceOS: verified, or where the chain breaks.

Steps

Download the verifier and a pack from Verify a pack, or the pack issued to your key from Start.
Check each file’s SHA-256 before you run anything, against the value you were sent. Verify a pack gives the command for your platform. If one character differs, do not run the file.
Run the verifier on the pack with --key and the pack key hash the institution sent you. The exact command is in Run it.
Read the result. VERIFIED means no record was changed after it was chained and signed, and the pack was signed with the key you were sent. Read the result shows the output.
If it does not verify, keep the output, the pack and the values you were sent, and ask the institution to explain. When it does not verify lists each failure and what to do.

The verifier is one Python 3 file under the Apache 2.0 license. It runs offline, with nothing to install and no account.
Only a run with --key reads VERIFIED. Without it, the verifier can say only that the pack agrees with itself.
A pack carries the public key that signed it, so on its own it shows only that it agrees with itself. The pack key hash you were sent ties it to the institution. Keep it on file: it stays the same for every pack the institution signs.
A consistent chain of false records verifies perfectly. The chain proves integrity; the institution proves truth.
To see a failure, run it on the sample pack for Nebula Mutual, a fictional institution, with one record changed. Verify a pack has both files.

These open the prototype, on fictional institutions. People are shown as roles.