Check the signed SSP² specification.

The SSP² specification on Zenodo, DOI 10.5281/zenodo.23490841, is signed. With the four files on this page you can check, in your own browser and with no network, that the zip you downloaded is exactly the one that was signed, and which keys signed it.

How to check

1. Download the zip from Zenodo: ssp2-vintage-2.zip.
2. Save three files from this page: the checker, os-verify.html, and the two files it checks with, os-vintage.json and owner-log-6f3293b2.json.
3. Open os-verify.html from your own disk. It runs in your browser and sends nothing anywhere.
4. Choose the zip as the deposited file, os-vintage.json as its sidecar, and owner-log-6f3293b2.json as the operator's owner-log file. The operator log's id is already filled in. Press Check.

You should see Pass: this is version 1 as signed, then REAL keys: the operator keys it trusted are the ones the operator's owner log enrolls. Every check below it says Passed.

The checker trusts the operator log you give it. A later copy of that log could remove a key, so compare the copy's height and tip words, shown on the result, with ours: height 1, tip duduz-zomin jomur-vigih.

What was signed, and by whom

• The zip is SSP² vintage 2, the work's first published version: ssp2-vintage-2.zip, 63,949 bytes, SHA-256 98f6b0d5f41e82c71752031cb178ee858a0922d7f4995c9a6af5b6fc4d15a49a.
• The author, Darryl J. Nicke II, signed three records: the work, its version 1 (naming the zip's SHA-256), and the publish record that ties version 1 to DOI 10.5281/zenodo.23490841. His author key is os-key:sha256:d564f5107a4cf56fa0daf31abe3c7b266cce8ecac96569f86f017a2e24286c88.
• The CCS operator signed the root that covers those three records. Its key is os-key:sha256:eb7af4ef53bb7020c694a9d7287b90874b6c1f224cfa74d333797e1a0b2939ef.
• Each record carries two signatures: P-256 and ML-DSA-87, a post-quantum signature.
• The owner logs say whose keys these are. Each log was opened with three root keys held on paper, any two of which sign every later change. Its first record enrolls the key above. The operator log, opened 21 Oct 2026 at 22:08 UTC, is own:6f3293b20b5f1c7f3ffcd86fbc50fa6dcb4841b05f394f9a17f27661f42854a2. The author log, opened at 21:36 UTC, is own:d6e0dfadb60afd5b168e4318e9efb95c3f061d4a9b5b877b218ce6efebd80bb7 (height 1, tip titat-poruz pofal-mivut).

The checker trusts the root's signer because the operator log enrolls its key. It shows the author's key with the result, but it doesn't yet check that key against the author log: compare it with the key above, which the author log enrolls.

The sidecar carries the version record and the signed root. The work record and the publish record that names the DOI are covered by that root, but they are not in these files, so the checker doesn't show them.

The files

File	What it is	SHA-256
os-verify.html	The checker: one self-contained page. Its content security policy allows no network.	633f520896115fbef0b3071986a6a96d51b1a9dbd6030c99c6043c5d2c08076c
os-vintage.json	The sidecar: the signed version record, its place in the signed log, and the signed root.	a4a0e3132a2c8e967880fe93c379235ed9298211c654746e016150b950bb4ca2
owner-log-6f3293b2.json	The CCS operator's owner log.	963ea2399df7adeff84b1f7cb11a8e946c5e925955576913bfb00a77516e0f68
owner-log-d6e0dfad.json	The author's owner log.	99d26d838c5f2ec721aae9addf5f2268a5e54f2ff3719ca6490d01274e0ac0ae

None of these files holds a secret. They hold public keys and signatures only. The same files are on Zenodo, in the record's newest version. DOI 10.5281/zenodo.23490841 is the signed version, and it holds the zip alone.

Back to Brother Nature