Signed evidence · public sample
Don't trust the badge. Verify the signature.
Every AIOPS assessment produces an Ed25519-signed evidence artifact. Here is a real one — download it, verify it yourself with standard OpenSSL in under a minute, then change a single byte and watch verification fail. No other governance platform lets you do this from their website.
The files
Three files. One truth.
This is a sample artifact signed with a dedicated demonstration key. Production evidence is signed with per-tenant keys and anchored to an append-only hash ledger.
| File | What it is | SHA-256 |
|---|---|---|
| aiops-evidence-sample.json | The evidence artifact — scores, framework coverage, evidence chain | a7e286224528ff5d68877df4e4bae157fd244828ce4eae7b277845c2a0a714ec |
| aiops-evidence-sample.json.sig | Ed25519 signature over the artifact bytes | — |
| oceks-sample-signing-pub.pem | Public verification key (demonstration key) | — |
Verify it yourself
One command. Any machine with OpenSSL 3.
If the artifact were altered by even one byte — a score, a timestamp, a model version — verification fails. That is the difference between evidence and a PDF.
- Deterministic: identical inputs always produce identical artifacts
- Tamper-evident: any modification breaks the signature
- Independent: verification needs nothing from OCEKS — just OpenSSL
- Chained: production artifacts reference the previous artifact's hash
# 1. verify the signature (OpenSSL 3.x)
openssl pkeyutl -verify -pubin \
-inkey oceks-sample-signing-pub.pem \
-rawin -in aiops-evidence-sample.json \
-sigfile aiops-evidence-sample.json.sig
Signature Verified Successfully
# 2. now tamper with it — and watch it fail
sed 's/95.45/99.99/' aiops-evidence-sample.json > t.json
openssl pkeyutl -verify -pubin \
-inkey oceks-sample-signing-pub.pem \
-rawin -in t.json \
-sigfile aiops-evidence-sample.json.sig
Signature Verification Failure
openssl pkeyutl -verify -pubin \
-inkey oceks-sample-signing-pub.pem \
-rawin -in aiops-evidence-sample.json \
-sigfile aiops-evidence-sample.json.sig
Signature Verified Successfully
# 2. now tamper with it — and watch it fail
sed 's/95.45/99.99/' aiops-evidence-sample.json > t.json
openssl pkeyutl -verify -pubin \
-inkey oceks-sample-signing-pub.pem \
-rawin -in t.json \
-sigfile aiops-evidence-sample.json.sig
Signature Verification Failure
Every audit answer, signed like this.
Auditors, regulators and insurers get artifacts they can verify independently — not screenshots they have to believe.