Verify
Provenance — confirm the build manifest is signed by my key:
gpg --keyserver hkps://keys.openpgp.org --recv-keys 16904BF09ED60395BC40A2AF62E1D169A1BA5E55
curl -sO https://www.ieuan.net/.well-known/build-attestation.json
curl -sO https://www.ieuan.net/.well-known/build-attestation.sig
gpg --verify build-attestation.sig build-attestation.json
Integrity — every entry in the manifest is a SRI sha384-… digest, the same strings as this page's integrity= attributes. Recompute any asset and find it in the manifest:
curl -s https://www.ieuan.net/path/to/asset | openssl dgst -sha384 -binary | openssl base64 -A
Or check the whole build in one go with scripts/verify-build.sh.