How to check a whole workspace offline

Download an audit export for the workspace or your account-level chain. It includes every receipt, the public keys and the chain head. Check each receipt's signature with the included keys and walk the prevHash links from the first receipt to chainHead. Nothing needs to call ClearRun.

Last updated

Steps

  1. Export the workspace

    curl -s "https://api.clearrun.net/api/audit/export?workspaceId=WORKSPACE_ID" \
  -H "Authorization: Bearer $CLEARRUN_API_KEY" -o clearrun-audit.json

    Needs a Business or Enterprise workspace. Leave out workspaceId to get every chain you own as an object with "scope": "account" and a bundles array, and check each bundle the same way. See How to export a workspace's receipts (GET /api/audit/export).

  2. Check every signature

    For each entry in receipts, run the same signature check as for one receipt, using the key in the bundle's jwks whose kid matches keyId.

  3. Walk the chain

    Start at the receipt whose prevHash equals the bundle's genesis. From each receipt, the next one is the receipt whose prevHash equals its receiptHash. Every receipt must be reached, with none left over, and the last receiptHash must equal chainHead. Also check each receiptHash: it is the SHA-256 of the 11 signed fields plus signature, as sorted-key JSON.

  4. Check verdicts

    For each entry, the SHA-256 of the publicVerdict (as sorted-key JSON) must equal the receipt's verdictHash. On 1.1.0 receipts that verdict is the coarse result plus a digest of the named signals. On 1.0.0 receipts it is the whole stored verdict.

Keep the file

The bundle is a point-in-time copy. Store it where you keep other records.