DE EN
Request a demoA LogIQ report can be exported as one signed archive holding every file behind it. Anyone handed one can check that it came from us and that nothing in it was changed.
Drop the .tar.gz you were sent onto this page and find out in a second.
The check runs on this page, on your own machine. Nothing is uploaded: a report package holds your traffic, and you should not have to send it to us to find out whether we signed it. This page has no server side and stores nothing.
The page above is a convenience, not the authority. Everything it does you can do with a public key and two standard commands, and you should, if the report matters. What follows is the same check, done by hand.
Every report package we sign is signed with this key. It is public by design; it can only check a signature, never make one.
One script, one dependency, no part of the analyzer needed. It answers both questions, is the manifest ours, and is every file still what the manifest says, and exits 0 only if both passed.
pip install cryptography
python3 verify_report_package.py package.tar.gz
Two standard commands. The first needs OpenSSL 3.0 or newer for Ed25519, the
openssl that ships with macOS is LibreSSL and cannot do it.
openssl pkeyutl -verify -pubin -inkey logiq-report-key.pem \
-rawin -in MANIFEST.json -sigfile MANIFEST.json.sig
sha256sum -c SHA256SUMS
What the archive contains, what checking it proves and what it does not, and what each failure means.
Five pages, A4. For the recipient of a package: the contents, both checks, the manifest explained field by field, and every failure message with what to do about it.
A signature says who produced a file. It never says the file is the right one to be looking at. A package that checks out is one we produced and that nobody has altered since. It is not a statement that the verdict is correct for your fleet, that the recorded traffic is representative, or that the person who sent it to you was entitled to send it.