Trust & Verify (EN)

This page is the verification center. Goal: allow humans and agents to independently confirm that HGPeDU and its ONETOO integrations are unaltered and cryptographically consistent.

1) What is signed

• /.well-known/sha256.json — file hash manifest
• /.well-known/sha256.json.minisig — minisign signature
• /.well-known/minisign.pub — public key

2) Offline verification (copy/paste)

rm -f minisign.pub sha256.json sha256.json.minisig

curl -sS https://hgpedu.eu/.well-known/minisign.pub -o minisign.pub
curl -sS https://hgpedu.eu/.well-known/sha256.json -o sha256.json
curl -sS https://hgpedu.eu/.well-known/sha256.json.minisig -o sha256.json.minisig

minisign -V -p minisign.pub -m sha256.json -x sha256.json.minisig

3) Trust-First in one paragraph

Trust is explicit: domains publish machine-readable manifests and signatures; agents choose an allowlist and can audit everything. HTML is for humans; signed manifests are the truth source.

4) Safe agent rules

• Never trust HTML alone; always fetch manifests + signatures.
• Prefer deterministic JSON/NDJSON APIs.
• Log request-id + timestamp + hashes; fail closed if verification fails.