Verify a report

Every ModelIndex report is signed with the RunMyAI software-attestation key over the exact bytes of its payload. A report that verifies came from a genuine build and was not changed after signing; one altered byte and it fails. The report carries no identity, so verifying it reveals nothing about who sent it.

Check it yourself

Save the signed report as report.json and run this line. It fetches the published key from /.well-known/modelindex-key.pub and checks the signature with OpenSSL -- no part of this site is trusted. It prints “Signature Verified Successfully” for a genuine report.

curl -s https://itstime2.runmyai.app/.well-known/modelindex-key.pub | base64 -d | (printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00'; cat) > key.der && jq -jr .payload report.json > payload.bin && jq -r .software_signature report.json | base64 -d > sig.bin && openssl pkeyutl -verify -pubin -inkey key.der -keyform DER -rawin -in payload.bin -sigfile sig.bin