Vertex Infrastructure Group Network logic as a service · evidence verification

Verify an evidence bundle.

Every change Vertex delivers closes with a signed evidence bundle: the plan, the pre-change state, every command run, the post-change verification, and the rollback steps, chained in a tamper-evident ledger. You can check it offline, with nothing but Python, against the keys published on this page.

Published signing keys

Compare the key id that VERIFY.py prints with this table and with your engagement paperwork. A bundle signed by a key that is not listed here was not signed by Vertex.

Key id
0f20f5f4467901fc
Algorithm
Ed25519
Public key
e6daa9a6b856edbaaeeb63e22766332a6170bcb6533e9af7a24f3135358a1318
In service from
25 September 2026

Keys are rotated by adding a new row, never by editing one. Bundles already issued keep verifying against the key they were signed with.

Three commands, offline

The bundle is a zip archive that carries its own verifier. It uses only the Python standard library; nothing is downloaded and nothing is sent to Vertex. 

unzip evidence-<job>.zip -d evidence-<job>
cd evidence-<job>
python3 VERIFY.py . --expect-key-id 0f20f5f4467901fc

It prints one PASS or FAIL line per check and ends with VERIFIED (exit 0) or NOT VERIFIED (exit 1).

What a pass proves

  • The files are the files we signed. Every artifact matches the SHA-256 and byte count recorded in the signed manifest; nothing was added or removed.
  • The record is unbroken. The ledger chains from its first event to the signed head; no event was inserted, altered, reordered, or removed.
  • Every artifact was recorded when the ledger says. Each file points at the ledger event that attached it, with the same digest it has now.
  • Vertex signed it. The manifest signature verifies with the key whose id you compared against this page.

What it does not prove is that the recorded device output is true; the chain is tamper-evident, not omniscient. Output captured from a simulator rather than vendor software is labelled [vertex-sim] in the text, and output taken over an engineer's direct console rather than through our platform is labelled direct-console. We keep those labels because the distinction matters to you.

Questions about a bundle

Send the job id and the key id the verifier printed.

[email protected]