ENGINEERING BLOG

Checksums, Signatures, and Trust

A preservation archive that just says “we have a copy of this” isn’t saying very much on its own. The more useful claim is “we checked, recently, that this copy still matches what the project actually published” — which is what FKPF’s Verification feature is for.

Software entries can declare one or more verification targets: a download URL per platform build, plus whatever SHA-256 and/or SHA-512 checksums the project publishes for it. On a recurring schedule, FKPF re-downloads each declared file and compares its hash against what was declared. Nothing here is simulated — if the file, the checksum, or the network is unavailable, the check honestly reports that instead of a false pass.

We were equally deliberate about what this doesn’t do. GPG signature verification isn’t part of it: most projects sign one combined checksums manifest rather than each installer separately, which doesn’t map cleanly onto a per-file check, so claiming to verify signatures here would overstate what’s actually being confirmed. The same goes for “reproducible build” — actually proving that requires rebuilding from source in a controlled environment, real infrastructure work that stays out of scope for now and remains a self-reported flag instead.

The goal is a checklist that only ever claims what it actually checked. A narrower, honest tool is worth more here than an impressive-looking one.