Attest integrity, at a date.

What it attests

Two things, at a given date:

• the integrity of an .obf archive;
• the fixity of a file: its SHA-256 checksum matches its reference.

A dated state

The certificate states what was observed at its date. It says nothing about what happened afterwards: that is what later audits are for.

Online verification

Every certificate prints an address vault.obscuraflow.app/c/<number>/<version>. The page it opens checks, in the browser and without uploading the file, the Ed25519 signature of the certificate you drop, against the key the issuer publishes, and that the signed number and version are those of the address. It answers with one of five results: valid, invalid signature, unreadable certificate, unknown key, unsupported version.

Register status (superseded, revoked) cannot be queried online yet: the page shows it as “unknown outside the register”.

In the app, “Verify a PDF…” checks the certificate offline and also gives its status in the installation's register and whether the printed text matches the signed values. Since version 1.2.0, the page is read there by an isolated service, with no access to the library, the keychain or the network.

Verify a certificate →

Certificate content

The certificate is a PDF/A-2b, the PDF meant for archiving, which embeds its manifest signed with Ed25519: the attested values, as data. It carries a number (for example OV-CERT-2026-00001), a version, its issue date, the issuer, the address where the issuer publishes its key, and the verification address in plain text and as a QR code. Its page is always written in French.

A missing value is written and signed, never left blank (“no check recorded”). No full path is printed.

• Archive: project, identifier, revision, date, SHA-256 checksum of the package, file count and checksum of the file list, last verification, locations and offsite copies.
• File list of an archive: a JSON annex handed over with the PDF, whose checksum is signed and printed.
• Incremental revision: the complete state of the project at that revision, from its signed inventory, not only the changed files.
• File: path within its project, size, SHA-256 checksum, last fixity check, archives that contain it.

Preservation certificates, in the user guide →