Virtum

Trust

Release transparency log

Every Virtum release, and every agent and relay build, is written to this list when it ships: what it is, its digest, where its signature and software bill of materials (SBOM) are published, and when. Entries are only ever added. Each one is chained to the one before it and signed, so a removed or edited entry is visible to anyone who checks.

Check it yourself

  1. Download the feed: /transparency/log.json.
  2. Download the verifier: /transparency/verifier.txt (save it as verify.php). It is one short PHP file that needs no network and none of our code.
  3. Get the signing key from /transparency/key and compare it with a copy you saved earlier.
  4. Run php verify.php log log.json --key <public key>. It rechecks every link, hash and signature.

The same verifier checks the signed audit exports and isolation reports a workspace can download from its own settings.

What the log does and does not show

It shows that a build was released, when, and the exact digest, so you can tell whether the image you run is one we published and signed. It does not show how the software behaves; for that, read our trust and security page.

Each time the log changes, its newest entry is also written to append-only storage kept apart from the log's database, and recorded back into the log as a checkpoint. No checkpoint has been written yet. Anyone who saved the head of the log at some point can check that the log still agrees with it.

Status

The log is empty. Nothing has been released through the signed release path yet; the first entry is written by that pipeline.

Keys

No signing key is published yet.