Technical note
How a Solvex report is signed, and how anyone can check it
Every issued report carries an Ed25519 signature over both its content and its file. Verification is public, needs no account, and reveals nothing about what the report says.
· 2 min read · written from the shipped implementation
What is signed
At issuance the report's content is composed into a canonical manifest and hashed; the rendered PDF is hashed; and an Ed25519 signature is computed over an envelope that binds both hashes to the report's identifier. The signing key never leaves the server process, appears in no database column, and is returned by no function — what is stored is the signature, the two hashes and the key version.
Two hashes rather than one because they answer different questions. The content fingerprint proves the findings are ours; the document fingerprint proves the exact file you hold is the one we issued. Both are covered by the same signature, so neither can be swapped independently.
The two identifiers
A report carries an identifier on its cover — SVX, a family code, a year and ten characters of randomness from a cryptographic generator. It is unguessable, non-sequential, and encoded in the QR code that leads to the verification page.
A verification reference, SVX-RPT-XXXX-XXXX-XXXX, is minted at issuance after the PDF has been rendered and signed, so it cannot be printed on the document; it is sent alongside it. Both use Crockford base32, which omits I, L, O and U and defines how to fold the mistakes people make reading a code aloud — an O typed for a zero resolves rather than being rejected.
shasum -a 256 report.pdf
# compare the first 16 hex characters with the document fingerprint shown at /verify — ignoring case and spacingWhat the answers mean
Verification answers one question — is this document genuine and unaltered? — with one of several distinct states, and the distinctions are the point. VERIFIED means the signature checks and this is the current edition. SUPERSEDED means genuine and unaltered, and a later edition exists. REVOKED means withdrawn by Solvex: still genuine, not to be relied on. NOT FOUND is a real negative answer. INVALID FORMAT means nothing was looked up. VERIFICATION UNAVAILABLE means we could not find out, and says nothing about the document.
The last distinction is the one most systems collapse. A failed lookup rendered as NOT FOUND accuses a person holding a genuine report of holding a forgery because of an outage on our side. The page is built so that cannot happen.
What verification never reveals
No title, subject, finding, evidence, successor identifier or revocation reason. Anyone with a reference can check authenticity; only the report's holder can read the report. Having the reference is not authorization.