Skip to main content
Skip to main content
FormaOS

Verify a FormaOS audit export

Paste an export bundle to recompute its Merkle root, or paste a Sigstore Rekor entry to confirm the published top-of-chain hash was witnessed by the public transparency log. Both verifications run entirely in your browser via SubtleCrypto, nothing leaves your machine except the public Rekor lookup.

1. Merkle bundle verifier

Paste the JSON contents of audit-log-*.json. Verifies every leaf hash + every inclusion proof against the published root.

2. Rekor anchor verifier

Confirms the named Sigstore Rekor entry recorded the expected top-of-chain hash + verifies the signature against the entry's embedded public key.

Want the source? The CLI equivalents live at scripts/verify-export-merkle.mjs and scripts/verify-rekor-anchor.mjs in the FormaOS repository. This page wraps the same logic in client-side SubtleCrypto so an auditor can verify without installing anything.