Verify evidence

Recalculate every artifact hash, prove each page's Merkle membership, validate the trusted Ironfang signing key and check the RFC 3161 timestamp.

Choose an Ironfang Audit evidence ZIPThe bundle is sent only to the public verification endpoint for this check.

Offline verification

Verify without uploading

Ironfang Audit Verify is open source under Apache 2.0. It checks the complete evidence chain locally without contacting Ironfang Audit.

ironfang audit verify -bundle evidence.zip \
  -trusted-public-key ironfang-audit-ed25519.pub \
  -tsa-ca tsa-chain.pem

OpenSSL is required for RFC 3161 timestamp verification. The signing key must be obtained independently from the evidence ZIP.