Check a claim yourself
Nothing in this protocol requires access to Revow infrastructure, because there is none. A claim is a file, its name is its digest, and every check below runs on your own machine against sources you choose.
The procedure
- Get the document and the signature
From wherever they were handed to you. The location carries no authority.
- Canonicalise and hash
Sort the keys, strip the whitespace, take the SHA-256. It must equal the identifier you were given. If it does not, stop: you are not looking at the document that was signed.
- Recover the signer
Recover the address from the EIP-712 signature. It must equal the subject field. If it does not, stop.
- Check the window
Now must fall between issued and expires. An expired claim is finished, whatever else is attached to it.
- Check for a withdrawal
Look for a signed revocation, and query the anchor contract if you use one.
- Check the domain binding
Resolve the _revow TXT record at the claim domain and look for the subject key.
- Collect attestations and decide
Gather what exists, keep what comes from attesters you have chosen to care about, discard the rest. Nobody can do this step for you.
- Render age, not a verdict
Say what was seen and when. Never show a tick.
Step two, running here
This is the identifier step, implemented in the page. Nothing is sent anywhere, there is no network call, and the result is the same number the shell command below produces on your own machine.
Two checks this tool does not do: it does not recover a signature, and it does not resolve DNS. Both need a library or a network and both belong in your own implementation, not in a page you are reading.
The same thing in a shell
jq -cS . claim.json | tr -d '\n' | shasum -a 256Run that against the document above and you get the digest below. That is the whole of the identifier definition, and the fact that it is reproducible with two tools that were already on your machine is deliberate.
claimId = fba0fc855026ba9758a1bbb2a41b3a4a5ebe54be5aca29b07c034d5c0e04ae10If a future version of this specification ever requires a tool you have to install to check a claim, that version is wrong.
What a correct check still does not tell you
Every check above can pass on a claim made by somebody who copied a real licence number. What they establish is that a specific key said a specific thing at a specific time and has not withdrawn it, and, at level 1, that the key is published on a domain. Whether the person behind the key holds the licence is open problem OP-1, and until an authority answers it, no amount of checking closes that gap.