Verify records yourself

What the open verifier is#

geometer-verify holds two things:

• `geo-verify`, a command-line program and Rust library that checks an exported evidence pack and an assessment certificate using only files you give it. It uses no network, no database and no Geometer installation.
• The contract schemas that the records follow, with generated Rust, TypeScript and Python code and shared test vectors.

It is licensed under Apache-2.0 and is in alpha, so the formats may still change. Geometer itself is closed source. A copy of geo-verify also ships with Geometer and is linked next to geo, but the point of the open repository is that a reviewer can build it from source, read the code that decides what "verified" means, and run it without installing Geometer.

What a result means#

geo-verify answers one narrow question: do these bytes match what an anchor or key that you chose to trust says they should be?

Build it#

You need Rust. The repository pins the toolchain in rust-toolchain.toml, and rustup installs it on first use.

git clone https://github.com/GeometerLabs/geometer-verify
cd geometer-verify
cargo build --locked --release -p geo-verify
# the program is at target/release/geo-verify

To run the tests, use cargo test --locked. The repository's README lists the further checks for the generated bindings.

Check an evidence pack#

An evidence pack is a JSON file that holds one tenant's slice of the record: entries, signed checkpoints, the key log and any declared gaps. You get one from geo prove export. You also need at least one anchor that you saved earlier somewhere the pack's owner cannot change. See Prove and certificates.

geo-verify pack.json --anchor anchor.json
echo $?

The repository includes a small signed pack and two anchors to try, in crates/geo-verify/tests/fixtures/profile. All keys and seeds in the fixtures are public synthetic constants and must never be trusted for real data.

The same check from Geometer is geo prove verify PACK --anchor FILE. The verify page on this site runs the same core in your browser. Selected files stay on your device. It is the same implementation in a different interface, not an independent verifier.

Check an assessment certificate#

An assessment certificate (a report made by geo assessment) can be a folder with bundle.json and its evidence files, a bundle.json file, or a bare assessment record.

geo-verify assessment ./assessment-bundle --trust-key issuer-key.json

Keys come only from you, with --trust-key and --key-log, never from the bundle. A report with no key you trust is unverifiable (exit 3). A changed or wrongly signed report is invalid (exit 1). You can also pin what the certificate must be about and ask for freshness:

Run geo-verify assessment --help for the full list. Get the key file from the person who made the report by a route you trust, for example one they made with geo assessment key.

Formats and versions#

The evidence pack is geometer.evidence-pack version 1 and the assessment bundle is geometer.assessment-bundle version 1. Inside a version, schema changes are additive only. The repository's documents describe the formats: the evidence pack and the contracts. To report a vulnerability in the verifier, see its security policy in the repository.

• Verify in your browserCheck a supported evidence pack against anchors, locally.
• Prove and certificatesHow the records are made.