Verify

Every page on this site is signed. When I publish, a script hashes every file the site serves (pages, stylesheets, and fonts) into a manifest, and I sign that manifest with an SSH key that never leaves my laptop. The footer of every page shows the commit it was built from and the key that signed it.

The steps below let you check this yourself: download the manifest and its signature, verify the signature against my public key, then compare a page’s hash with its line in the manifest. A page at /writing/ is listed as /writing/index.html. If the hashes match, the bytes you received are the ones I approved.

Don’t take this page’s word for the key. The same fingerprint is on my GitHub profile, so check that the two agree before trusting either.

What this doesn’t prove: that the site was built from its public source code, or that my laptop wasn’t compromised. It proves that nothing changed between my machine and your browser.

Attestation is my central research focus, so why not apply its core idea, proving rather than asserting, at a micro level on my own site?

Signing key

+--[ED25519 256]--+
|            o .  |
|      .      * . |
|     ...    E .  |
|.  ..o ..  o .   |
| o.oo ..S   o .  |
|+.*..o.. . . o o |
|o*.ooo+ = o = o .|
|+.. ++.+ + o o . |
|.o.. oo.o..      |
+----[SHA256]-----+

1. Download the manifest and its signature

curl -O https://mdoyle.dev/manifest.txt
curl -O https://mdoyle.dev/manifest.txt.sig

2. Save the public key

echo 'michael namespaces="mdoyle-site" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHStX1TdJwXWb/Biz1/Tk2CsBPOnx3En6RKrXEa6DPZt mdoyle-site signing' > allowed_signers

3. Check the signature

ssh-keygen -Y verify -f allowed_signers -I michael -n mdoyle-site \
  -s manifest.txt.sig < manifest.txt

4. Check a page against the manifest

curl -s https://mdoyle.dev/ | shasum -a 256
grep ' /index.html$' manifest.txt