aplark-verify
Check the evidence without trusting us.
A free, unrestricted static binary that verifies an Aplark evidence bundle offline. No account, no licence, no network, no relationship with Aplark required.
Free and unrestricted
There is no licence check, no registration, no usage limit and no telemetry. It is intended to circulate independently, including to parties who have no reason to trust us.
Offline by design
It runs on a machine that has never contacted the server that produced the bundle. Everything needed to check a claim travels inside the export.
Usable from --help alone
A reviewer who has read only the tool’s own help output must be able to complete a verification. That is a product requirement, tested with external participants rather than assumed.
Built to outlive us
A static binary with no runtime dependencies, verifying a self-contained bundle in a documented format. Evidence is expected to remain checkable for decades, including if the company does not.
What it checks
- Ledger inclusion and consistency proofs, against the root recorded in the bundle.
- Signature validity on every record, against the trust root supplied on the command line.
- Canonical byte agreement, so that a record’s signature covers exactly the content presented.
- Artefact digests, confirming that each cited artefact is the one that was assessed.
- Provenance completeness, reporting any claim whose lineage does not resolve.
Shape of the tool
aplark-verify bundle ./export-bundle --trust-root ./roots.pem
aplark-verify claim REQ-VIS-021 --bundle ./export-bundle
aplark-verify gate --artefact sha256:… --platform … --criticality …On failure every failing rule is named with its message. There is no bare "denied" anywhere in the tool.
Availability
aplark-verify ships alongside Aplark Assure. It is not separately licensed and it is not restricted to customers. If you have been sent a dossier and need to check it, you are the person this tool is for.