Viewer integrity
The Viewer establishes trust at three layers on every session - the document it opens, the plugins it loads, and itself. Each is verified independently, and any mandatory failure stops the session rather than degrading it. There is no "verify the file but trust the app" gap: the thing doing the verifying is verified too.
Document verification
Every opened OSDF package is verified end-to-end by the shared Rust/WASM core against the format specification:
- Container - strict, constrained ZIP parsing with a declared object table.
- Manifest - per-object SHA-256 digests recomputed and matched.
- Signatures - Ed25519 signatures verified and signers resolved.
- Lineage - hash-linked revision chain validated.
- Transparency - inclusion and consistency proofs checked against the log.
This is the same computation available at /verify - the Viewer runs it locally on open, before rendering. Embedded evidence means the baseline checks succeed offline; a connection adds freshness and revocation checks.
Plugin verification
Before any plugin runs, the Viewer recomputes the SHA-256 of every declared file, verifies the publisher signature over the manifest, and rejects any undeclared file. Corrupted, tampered, unsigned, or revoked plugins do not load. The full mechanism is documented in Plugins, and org constraints in Plugin governance.
Self-verification
Each Viewer release is published to a transparency log, and the Viewer self-verifies its own binary at startup against that logged release. This closes the loop: a tampered or substituted Viewer build is detectable because its measurement will not match the transparency-logged, publisher-signed release.
- Releases are signed by the publisher and recorded in the log with inclusion proofs.
- The running binary's measurement is checked against the logged release.
- A mismatch is a mandatory failure - the Viewer reports it rather than proceeding as if trusted.
Fail-closed behavior
| Layer | Mandatory failure example | Result |
|---|---|---|
| Document | Digest mismatch, unresolved signer, bad proof | Rendering stops; failure reported |
| Plugin | Hash mismatch, bad/absent signature, undeclared file, revoked | Plugin does not load |
| Viewer | Self-attestation mismatch against the transparency log | Startup halts; tamper reported |
In every case the Viewer fails closed: it withholds the unverified result and surfaces why, instead of showing partial or unattested content.
What users and organizations can attest
- Users can confirm a document verified locally, see exactly which checks passed, and confirm the Viewer itself matches a transparency-logged release.
- Organizations can attest that managed devices run a known-good Viewer build, load only sanctioned and verified plugins, and enforce mandated controls - with every document, plugin, and binary independently verified. See Plugin governance and the security overview.