Pushgate.devDocs Open Pushgate.dev

Verify independently

Every trustworthy conclusion can be traced from exact bytes through identity, time, subject, policy, and repository bindings.

On this page
Independent verification pipeline A verifier starts with exact bytes, recomputes the content identifier, validates the certificate and timestamp, checks in-toto subjects, and finally checks repository, commit, nonce, and policy bindings. INPUTExact bytes CONTENTRecompute ID IDENTITYCertificate TIMETimestamp SUBJECTin-toto CONTEXTPush bindings
Independent verification starts from exact bytes and ends with the context in which Pushgate used them.
Mermaid source
flowchart LR
    B[Exact bytes] --> D[Recompute content ID]
    D --> C[Validate certificate chain]
    C --> T[Validate trusted timestamp]
    T --> S[Check statement subjects]
    S --> P[Check policy and repository bindings]
    P --> R[Independent result]

Verification order

  1. Keep the exact bytes. Content identifiers are over the original DSSE envelope and decoded payload bytes, not reformatted JSON.
  2. Recompute the identifiers. Compare the raw Git-blob SHA-256 gitoid and ordinary payload SHA-256 with the signed or stored references.
  3. Validate identity and time. Build the Fulcio certificate chain to the platform trust bundle and validate the RFC 3161 timestamp chain at signing time.
  4. Inspect the in-toto Statement. Check the subject digests, predicate type, predicate schema, and policy-required result fields.
  5. Check the decision context. For a VSA, verify repository, immutable repository ID, tenant, commit, nonce, nonce scope, and policy identity before reading the outcome.

Discover platform trust

The hosted platform publishes endpoints and trust material from one discovery document:

shell
curl -fsSL https://platform.testifysec.com/.well-known/judge-configuration

Use the returned trust_bundle_pem for the Fulcio chain and tsa_cert_chain_url for timestamp verification. Do not trust a certificate because its display name resembles the platform.

Verify with CI/lock

CI/lock can evaluate a Witness policy against local attestation files, a portable evidence bundle, or tenant-scoped evidence in Archivista. Use cilock verify --help from the deployed binary for the exact flags available in your environment. Gate automation on the command’s exit status or machine-readable output, never on text scraped from its human log.

Questions a reviewer can answer

  • Which identity signed these exact evidence bytes?
  • What trusted time covers the signature?
  • Which commit or artifact is the Statement about?
  • Which immutable policy identity was evaluated?
  • Which tenant and repository incarnation were bound?
  • Did the policy pass, fail, or produce no enforceable decision?