How to verify a publication

Everything needed to check a publication is public and can be downloaded. None of it requires our cooperation, and none of it depends on trusting our clock.

1. Get the publication and its manifest

ID=OT-2026-000000001 BASE=https://opentechnical.org/p/$ID curl -sO $BASE/publication.txt curl -sO $BASE/publication.pdf curl -sO $BASE/manifest.json curl -sO $BASE/manifest.sig curl -sO $BASE/merkle-proof.json

2. Check the files against the manifest

jq -r '.files[] | "\(.sha256) \(.name)"' manifest.json | sha256sum -c

Every file the manifest lists must hash to the value recorded there. The figures are listed separately under .figures[] with their own hashes.

3. Check our signature over the manifest

curl -s https://opentechnical.org/integrity/keys.json \ | jq -r '.keys[-1].public_key_pem' > ot.pem base64 -d manifest.sig > manifest.sig.bin openssl pkeyutl -verify -pubin -inkey ot.pem -rawin \ -in manifest.json -sigfile manifest.sig.bin

4. Check the independent timestamp

This is the step that does not rely on us at all. The manifest hash is a leaf in a Merkle tree; the tree's root was submitted to an independent RFC 3161 Time Stamping Authority, which signed it with its own key and its own clock.

BATCH=$(jq -r .batch_id merkle-proof.json) curl -sO https://opentechnical.org/integrity/batches/$BATCH.tsr ROOT=$(jq -r .merkle_root merkle-proof.json) openssl ts -verify -digest $ROOT -in $BATCH.tsr -CApath /etc/ssl/certs

Then recompute the root from your own copy of the manifest hash and the inclusion path in merkle-proof.json: leaves are SHA-256(0x00 || data), interior nodes are SHA-256(0x01 || left || right), and an odd node is promoted rather than duplicated. If your recomputed root equals the root the authority signed, the timestamp covers your copy of the publication.

5. Check that it was publicly retrievable

The publication's integrity record lists independent retrievals: the URL requested, the time, the HTTP status, the response headers and the hash received, recorded by infrastructure separate from the publication system. You can repeat the exercise yourself from any network at any time, with no account and no credential, which is the point.

6. Check the publication log

The append-only log records the publication on the day it happened. Each day's file is hashed and signed when the day closes, and the day hashes are themselves carried into the timestamp batches.