Out-of-band anchor

Verify anything we ship.

Everything whodar produces can be checked without trusting us, our server, or even the binary in your hands. These are the canonical keys, published here so a relying party never has to take a compiled-in constant's word for it.

01 // Releases

Every release is signed.

Each release's checksums.txt is signed with cosign. The public key below also lives in the repository as cosign.pub; the two must match.

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY3jgi3fMoIYimaiYYWkI5i+EPAwC
pa7rjq7OMnhQI9cYP7bZ4h9NfRgacRzD7NAE0OMomyqCtEAQtW66dZ27uA==
-----END PUBLIC KEY-----

cosign verify-blob --key cosign.pub --bundle checksums.txt.bundle \
  --new-bundle-format checksums.txt
shasum -a 256 -c checksums.txt --ignore-missing

02 // Licenses

The signing keys, by name.

A whodar license is a small signed file, verified offline against these keys. A license names its key in a kid field. A key that leaves this list is revoked, and licenses naming it stop verifying in current builds. One key today; the list is plural on purpose.

kid            key (ed25519, base64)                          status
kordloom-2026  5cdDIgH/DWQHWpGF8yjfM9EbKE/7jwfGM+O/hmkigJM=   active

03 // Sealed findings

Check a finding offline.

A knowledge-risk finding exported from whodar is a LoomSeal bundle: the claim, a digest of the evidence behind it, and an ed25519 signature over a tamper-evident chain. Anyone can verify it with the open-source verifier, no account, nothing sent anywhere.

loomseal verify whodar-knowledge-risk.loomseal.json

Two honest caveats, because trust that cannot name its limits is not trust. A bundle's signing key is generated per install, so the signature alone proves the finding is intact and from one consistent install, not who ran it. And a run of the intelligence layer without a license carries "evaluation": true inside the signed payload; it cannot be removed without breaking the signature, so a licensed report and an evaluation can always be told apart.

A licensed install goes further: its license names the install's sealing key and rides inside every sealed payload, so the seal is provably issued to that organization, verifiable against the key list above. Check any bundle's licensing chain with whodar attest verify FILE; a fork can strip a label, but it cannot mint this.

04 // Accuracy

The numbers are reproducible.

The ranking and drift figures whodar publishes come with their measurement harnesses in the repository: eval/verify_drift.py checks drift findings against raw git history rather than against whodar, and the simulation gauntlet under internal/simorg scores the ranking end to end. Run them against any claim, ours or a lookalike's.