Verify without trusting us

This is the page the whole product stands on. Every claim OLOBOLO makes reduces to things you can recompute — with our open-source verifier, or without any OLOBOLO software at all. Verification is free at every tier, always; a paywall here would defeat the point.

Sixty seconds of it, on screen — the terminal output below is the real olobolo-verify transcript, captured when the video was generated, including the red tamper detection:

Read the transcript

• Verify without trusting us. No account. No network. Open source.
• Export your chain. Run the open-source verifier — offline.
• The verifier reads the export and reports the chain intact.
• Now flip a single bit in the export…
• The verifier fails the exact entry: one flipped bit, caught in milliseconds — offline.
• OLOBOLO — evidence you can check, not claims to take on trust.

1. Get the export

curl -o chain-export.jsonl https://api.olobolo.com/v1/export/<repo>

One canonical JSONL line per chain entry. Report recipients can request the same export from the organization that sent the report.

2. Run the verifier

olobolo-verify verify chain-export.jsonl

The verifier (@olobolo-com/verifier, Apache-2.0, zero dependencies) recomputes, for every entry:

1. the payload hash from the canonical payload bytes,
2. the entry hash from the envelope,
3. the link to the previous entry.

Exit code 0 = intact; 1 = broken, with the exact entry and reason. Run olobolo-verify selftest first if you want the verifier to prove itself against the published test vectors.

3. Verify without our software

Distrust healthy enough to exclude our verifier too? The format is public and small: canonical JSON (bytewise key order, UTF-8, no whitespace) hashed with SHA-256. A few dozen lines of Python against the spec reproduce every hash — we routinely cross-check our own chain with an independent implementation, and the format page links the test vectors so yours can prove itself the same way.

4. Sample the content

The chain holds fingerprints, not content. To audit substance: pick entries, request the referenced material from the organization (the diff, the spec version, the CI artifact), hash it locally, compare with the recorded fingerprint. A match proves that exact content existed, at that point in the chain, when the entry was written.

5. Check the clock

Chain order is internal; anchors pin it to real time. Each receipt is an RFC 3161 token over the chain head from an independent European TSA:

openssl ts -verify -data head.txt -in receipt.tsr -CAfile ca.pem -untrusted tsa.crt

Verification: OK from openssl means the head hash existed no later than the token’s timestamp — on the TSA’s authority, not ours.

What a pass actually proves

An intact chain + matching samples + valid anchors prove: this sequence of recorded events existed as-is, at anchored points in time, and the referenced content matches its fingerprints. What it does not prove is covered honestly in the FAQ — read that page too; we mean it.