Viewer overview
The OSDF Viewer opens, verifies, and renders OSDF packages. It is the reference client for the format: whatever a producer signs, the Viewer independently checks before a single byte is shown to the user. It never trusts the surrounding system - the network, the portal, the mail gateway - to vouch for a file. Trust is recomputed locally, from the file itself.
The Viewer does not display documents it cannot verify.
One verification core, two runtimes
All trust decisions are made by a single Rust verification core compiled to WebAssembly. The same code path validates the container, manifest digests, signatures, revision chain, and transparency proofs regardless of where it runs. The two runtimes differ only in their shell, not in their security logic.
| Runtime | Built with | Surface | Identity |
|---|---|---|---|
| Desktop Viewer | Tauri (native shell + WASM core) | Local files, removable media, offline use | Optional for viewing; required for org-scoped signing |
| Web Viewer | Browser + WASM core | Hosted access, no install | Required - login gated |
Because verification is shared, a document that verifies on the desktop verifies identically in the browser. There is no "lite" web check and "full" desktop check - the guarantees are the same.
What the Viewer verifies
The Viewer verifies three distinct things on every session:
- The document. Every opened OSDF package is checked end-to-end against the format specification: safe container parsing, per-object SHA-256 digests, signatures, lineage, and transparency proofs.
- Its plugins. Every loaded plugin is verified against a signed manifest before it runs. See Plugins.
- Itself. Each Viewer release is published to a transparency log and self-verifies its own binary at startup. See Integrity.
Operating principles
The Viewer inherits the format's security posture, described in full on the security overview:
- Fail closed. Any mandatory check that fails - a bad digest, an unresolved signer, a tampered plugin, a missing self-attestation - stops rendering. The Viewer reports the failure rather than showing partial or unverified content.
- Passive by default. Opening a document never executes document-supplied code. There are no scripts, macros, or auto-fetched remote content.
- Offline-capable. Embedded evidence lets the Viewer verify a document with no live service. Network access, where used, strengthens checks (revocation, freshness) but is not required to establish baseline trust.
Next steps
- Authentication - when identity is and is not required
- Plugins - the plugin capability and security model
- Plugin governance - org-policy lockdown
- Integrity - file, plugin, and self-verification