Provenance

Check a Provenance record

Open the dossier for a lot and check every party's records in your own browser: who signed each step, that nothing has changed since, that each party's records run without a gap, and that each handover was signed by the party that gave the lot and by the party that received it. The file is not sent anywhere.

Check a dossier

This check runs in your browser and needs JavaScript switched on.

What this check did not establish

Who any party is. A DID is a name a party chose for its key. Whether it belongs to the business on your contract is for you to confirm with that business, for example by comparing the key fingerprint they give you with the one shown here.
Whether anything a party declared is true. A grower's harvest record shows what the grower signed and when. It does not show where the produce was grown, what it contains, or that the statement is accurate.
What a referenced document says. Where the document is in this file, the page checks only that it matches its fingerprint; where it is not, nothing about it is checked.
That nothing was left out. A party can choose not to record a step. For each day root of a party in this file, the records shown for this lot match the count of records that party signed for the lot in that day root, or that party signed that it made none that day, so a record cut from the file or added to it shows. On a day whose day root is not in this file, a record of this lot would not be seen.
Whether a party made a correction after this file was put together, or one made after its last day root in this file was left out when the file was put together.
Whether the lot meets any law, standard or scheme, including the EU Deforestation Regulation.
The time of a record whose time stamp is absent or does not chain to an authority this page carries.
Whether a key was withdrawn. The page shows a withdrawal only as this file states it, unless you give it the key history yourself or list the keys you know were withdrawn.
Whether a party made later records for this lot that are not in this file. A record made after the last of a party's day roots in this file, such as a later record by the last party to hold the lot, a correction a party made after handing the lot on, or what a party did with an input lot after deriving from it, would not show.
Whether a party signed only one history. A party controls its own signing key, so it could sign a day root whose count for a lot leaves out or hides some of that lot's records, or sign a second branch of its chain for this lot, for example one handing the same lot to someone else as well. The page shows that this file agrees with what each party signed, not that a party signed nothing else. A buyer who needs more can ask that party for a dossier showing its records in full. The same holds for a party's records that belong to no lot: a dishonest signer could file a key or authorisation record among its erasure and disclosure records, which a file may leave out and of which this page only counts the ones not shown. Nor does the page show an attestation that another party made and that was never delivered through the platform to a holder in this file: no chain here records receiving it, so a file can leave it out and nothing in the file says so.
How a signing key was held. The record states how it was signed; this check cannot see inside a key holder's systems.

Details of what is ignored

Inclusion proofs. Where a party's records are in the file in full, the page rebuilds each day root from them, so a missing proof changes nothing.
The readable copy of each record. It is there for display only; the signed bytes decide.
The date the file was put together. It is not signed and is not read.
The names and types given to keys in a key document. Only the key itself is checked, against the fingerprint you give.

How the check works

Each record is signed by the party that made it, with that party's own key. The page checks every signature against the key in that party's key document, which travels in the file.
Each party numbers its own records in order and seals each day's records under one signed day root, which also states how many records the party made for each lot that day. For every day root of a party in this file, the file must show either that party's records of the lot with the count it signed, or its signed statement that it made none that day; the page checks both. So a record of this lot cut from a day whose day root is in the file, or from between two records of a party's chain, is found. A record in the file that no signed day root covers makes the file incomplete rather than verified. A record made on a day whose day root is not in the file cannot be found from the file at all.
A handover is two records: the giving party's proposal and the receiving party's acceptance, both naming the same terms. The page checks that both are in the file and that each is signed by its own party.
A seal, certificate or container number is recorded only as a salted fingerprint. Type the number you read on the seal, and the page tells you whether it is the one recorded.
To know who a party is, compare the key fingerprint shown here with the one that party gives you directly.
Each record says who stated it and how it was signed: the party's own statement, a separate organisation's signed record, or an instrument file the party supplied; and whether the key was held by the organisation's Village under a standing authorisation, held jointly with the Village, or held by the organisation's own custodians. The page shows that label with every record, and checks that each record signed by a Village names a standing authorisation in the file that covered it.
Each outside time stamp is checked against the authority roots this page carries. A stamp is labelled qualified only when a party in the file has confirmed the authority against its member state's trusted list and the trusted list this page carries says the same; any other stamp is labelled not verified as qualified. A stamp whose token is not in the file, or does not check, leaves the time it states not established, and the file is then not shown as verified.

Once this page has loaded, the check needs no network connection. The check is one script, which runs in your browser; nothing in the file you choose leaves your device. The script: provenance-verifier.js

Back to Village apps