The linked 2026-Q2 reports are historical documents with published hashes and Ed25519 signatures. Verification checks the document bytes and signed metadata. It does not establish data accuracy, current coverage or the quality of a later release. ← back to audit
Pick your stack to fetch the linked historical Cook County report and check its hash, signed metadata and signature. PASS exits 0; FAIL exits 1.
curl -sL https://propraven.com/audit/verify-attestation.sh | bash
curl -sL https://propraven.com/audit/verify-attestation.mjs | node --input-type=module
pip install --quiet cryptography requests curl -sL https://propraven.com/audit/verify-attestation.py | python3
Of course. The whole point of a verifiable artifact is you don't have to trust anything PropRaven hands you — including the verifier. Here are the manual steps:
# 1. Fetch the artifacts curl -O https://propraven.com/audit/sample.pdf curl -O https://propraven.com/audit/sample.json curl -O https://propraven.com/audit/attestation-public-key.b64 # 2. Hash the PDF and compare to manifest shasum -a 256 sample.pdf cat sample.json | jq -r .content_hash_sha256 # 3. Verify Ed25519 signature # (the canonical message that was signed is in sample.json:signature_message_canonical, # base64-encoded; the signature is in sample.json:signature_ed25519) # Wrap the raw 32-byte public key in DER SubjectPublicKeyInfo and verify # with openssl pkeyutl, or use any standard Ed25519 library. # 4. Compare the decoded signed metadata with the outer manifest claims. # The PDF hash, size, scope, run and dates must match the signed values. # A valid signature on unrelated metadata does not authenticate this PDF.
SHA-256 of sample.pdf bytes must equal thecontent_hash_sha256 field in sample.json. A single-byte tamper changes the hash.
Length of the PDF must equal content_bytes in the manifest. Belt-and-suspenders against truncation.
The signature in signature_ed25519 must verify against signature_message_canonical using the published public key at /audit/attestation-public-key.b64. The decoded signed metadata must also agree with the outer manifest's hash, size, scope, run and dates.
The linked reports use the published public key. A historical report needs the key that signed that report, retained with its manifest. The verification result does not establish a key-rotation schedule or the security of private-key storage.