Prove · Verify attestation

Verify attestation

The public verification page: paste an attestation, get an independent yes or no. Verify attestation checks a RepoOps attestation against its transparency-log record so anyone can confirm a claim without trusting the claimant.

What it does for you

Trust the proof, not the claim.Verification is independent of who produced the attestation, so the answer stands on its own.
Anyone holding the record can check it.Verification depends on nothing RepoOps stores, so you can hand the record and its key to an outside reviewer and they reach the same verdict with the offline CLI. The in-app page itself is not open to the public: the desktop app serves it on localhost, and the hosted tab needs a signed-in RepoOps account.
An offline verifier, no server required.The same verdict runs offline in the app: open Prove, Verify attestation and paste the record. It checks a signed authorship attestation with no RepoOps server, no account, and no network, through the same verifier the page uses. --pubkey pins the expected Ed25519 public key; --key <hex> is the legacy flag for older HMAC-signed records. Pass --log and --witness-pubkey to also prove the record sits in the externally witnessed transparency log. A tampered or unknown record fails honestly; there is no path to a false “verified”.

Where to find it

  • Desktop: http://localhost:4000/, then Prove → Verify attestation in the sidebar.
  • Hosted: repoops.ai/team/verify-attestation
  • Keyboard: ⌘ K, then type “Verify attestation”.

Built vs. planned

Shipped and live in the Prove category. Verification runs in the desktop app; the hosted dashboard has the tab and routes to where the verdict is computed. Emission of new attestation records is dormant until the operator sets REPOOPS_ATTESTATION=1.

Last updated