The website today
These details come from the published website release and its signed inventory.
| Captured | |
|---|---|
| Release | 20261005T191018Z-manual.woE6Dm |
| System | Debian GNU/Linux 13.7 |
| Web server | Caddy 2.6.2-12+deb13u1 |
| Website build | Zola 0.23.6 |
| TLS issuer | Actalis |
| Public IPs | 152.53.22.2482a03:4000:6c:b55::1 |
Download the manifest and evidence
The signature covers the exact manifest bytes. The manifest records hashes of the inventories and published files. It is our own dated inventory. Its signature does not replace an independent audit or an availability measurement.
- Website manifest (JSON)
- Detached signature (Ed25519)
- Public verification key (PEM)
- Website components and fonts (CycloneDX)
- Debian package inventory (CycloneDX)
- Files and SHA-256 hashes (JSON)
- Manifest schema (JSON)
Verify the signature
Public key fingerprint (SHA-256 of DER encoding):58f8495990a76f5049e5626e12ebdd4729bcf60abb7720123d0946ea08f3fab9
After downloading the manifest, signature and public key, verify the signature with OpenSSL. Obtain the verification key through a trusted source; downloading it from the same website alone does not establish the operator's identity.
openssl pkeyutl -verify -pubin \
-inkey manifest-public-key.pem \
-rawin -in manifest.json -sigfile manifest.sigWhat the manifest records
The signed sovereignty manifest describes this website and its host at the capture time shown. It is generated from the actual host inventory and the files of the website release, and it is renewed every day.
The downloads contain the manifest, the related software inventories, the public signing key and the signature.
Verify the signature
The published key lets you check whether the manifest has changed since signing. Verification instructions accompany the downloads. If you know the key independently, you can also establish its origin. When first downloading the key from the same website, trust in that key rests on the website's HTTPS connection.
The signature is a statement by the website operator. It does not replace checks of contracts and data centres or an external security or privacy audit. The inventories are a snapshot; they do not demonstrate continuous availability.
Government requests
We review every request legally. We hand over only what we are obliged to and inform the people affected where that is permitted. We publish the number and kind of requests on this page.