albertlane.net / audit
Build audit
Published under SECURITY-POLICY-BUILDS v1.0. Signatures are ECDSA P-256 (SHA-256) made inside a SoftHSM2 token with a non-exportable key. This page checks each one live in the Worker using the public key only. The source tarball is private; its digest is listed.
Release 2026-10-09-logs2 · SOURCE_DATE_EPOCH 1791529200 · signatures: 2-of-2 required for prod (grokbot + owner); owner key pending
| File | SHA-256 | Signature (checked live) |
|---|---|---|
| repro-report.jcs · .sig | aaafe05aea50b5ed76bc636f883327508d807134884d8b7e5dd310c557e548d3 | ✅ verified (aldi-grokbot-p256) |
| conformance.json · .sig | 064f0acdd46160edb02144a5a602fed9d31d844d34614989c8838dd699c29b0b | ✅ verified (aldi-grokbot-p256) |
| toolchain.lock · .sig | e1741db97137b580e82d38a9f93e3fa7ed46079ceeef47a5d9877a9d7d3454bc | ✅ verified (aldi-grokbot-p256) |
| aldi-signing-key.pem | f922e379b659bb54156bfc09fdd65f9a20eb0fd9e23575458a7c0eb56967577d | — |
| build-manifest-albertlane-apex.jcs · .sig | 943273811f2ccc580b2ca1c06863a8213b17f21d653c8deffa274e3dfd169e0d | ✅ verified (aldi-grokbot-p256) |
| build-manifest-meta-lane-api.jcs · .sig | a24e40f017d81f4bdbda714b1c55f5c90fabb868fab089ae22fd08e5d3660b54 | ✅ verified (aldi-grokbot-p256) |
| digests.jcs · .sig | 160a6fdc7ae5db4b7482cdbfea8317c55f22406e5f7a0b4d867d7b7fdce84b62 | ✅ verified (aldi-grokbot-p256) |
| source-PRIVATE.tar (private) | 0436f74af6af43f0b6d9112ca03e37f73ea84e397701fb906dbc70d5cdbc0c68 | — |
Verify yourself: openssl dgst -sha256 -verify pub.pem -signature <DER> file (the .sig files are raw r||s base64url, the WebCrypto format). Owner co-signature: pending: owner key not registered yet.