Verify this build
Re-hashes a sample of the assets served to your browser and verifies the release manifest's Ed25519 signature against a hard-pinned Aarmos key. A pass covers the sampled files and the signed manifest, not every file in the application. Runs entirely on-device. Does not block execution — this is a truthful verification result, nothing more.
Release gates
- Blackout profiles. CI runs the governance path with Aarmatix hosts, and then all network egress, black-holed. Policy evaluation, signing, and local verification must complete unchanged; a release that needs the network to govern does not ship.
- Clean-room portability. The open verifier core must resolve and verify a receipt with no network and no application code present.
- Build-provenance sidecar. Receipts may be accompanied by a detached
<receipt>.provenance.jsonrecording build identity only. It is optional: remove it and the receipt still verifies. See provenance.
CLI equivalent (evaluation CLI — not publicly issued): aarmos verify release https://www.aarmos.io
The pinned public key ships inside the app bundle. A fork can serve a valid manifest for its own build, but cannot produce one that verifies against the Aarmos key.
Limits: because the key is delivered with the same app it checks, this detects mismatched or altered assets but is not independent proof against whoever controls delivery. Compare the key fingerprint with one obtained from a channel you trust. Only a sample of assets is re-hashed, and a passing result does not by itself identify the source commit a build came from.