Proof

Check a download yourself.

No Avano release has been published yet, so there is nothing to check today. This page is ready for the day there is. It takes the APK, the signed build manifest and the SBOM that come with a release, and the release key we publish, and runs on them the same verifier as the command line avano-attest verify-apk: the same checks, in the same order, saying the same words. The files never leave your browser. The verifier is a WebAssembly module that imports nothing: it has no network, no clock and no way to send anything anywhere, only the bytes you hand it.

01 The check 02 What a pass means here, and what it does not 03 The answers it can give

01 — The check

Three files and a key. One answer.

The APK The signed manifest The SBOM (optional) The published release key (ML-DSA-87, hex)

f5def75188b3c7da8cdbf44b595a8878cad0a25c86e982db1cc7103b1c198c0aaf64d777ef7f712e7597d5f5cb5c32d34248b41abccbb8506e988d25c63f999a1f01991842a3f653a8b23276b4e051d0376f9d9e5faaf31f7090768c55fb8642d6aa3a09335b10c2394b7778e7341e49ea83db6e588e7dcc971e19bb80e954ce5e14c1d29ea6240be1e93ddc4cf9a608730c54665a505e8eb6cd4828b1ff28d7e7ccb4da994e3aed631a9bacf93797f2e6237d886d905a51ebfdd7c18733b144cc503f2fd7bb01d6b735e0b09763faef94a6011366c987474719381933654745f7b0f46f23639c537557ca69c8516fb1cea2e424dab28708cc122307f8f314ffbd01ab217b8e7d29ab6eacbc564ccfd335bc7b814bf453c8f955b406e01cbff58cb7d3a24ab0fd6ab1dbe9d76591fd5d0059f93bb9c0fd6015cf31b15a77ddcb4f0d551a4421144f9e069feebe8b4aa333de17efaf8a392ce6fd3216623a162f547f280c252b5d51bfe232634b9f3a6589b6127355f8334237a84fc51e07aeecd086cf43b36f938da026125c3844f3dee6b1c7831568a7118cb5703d81f9a76fdf3419d4f004feb348b3a074421857e5323beb32988fc1609c84869b7ca23d5cd7580d27c5b1ce0498c37bfbe2b070c862d4e5a63d86b4cb3f9a340f86c51b8e4f355a9abb29b8ed26f6fed14d3f82d8102b080e3fe6e7e20e02fb0a84a2a303e57d9a8e4ea98a56d7e570b0de65ce1836e6388a3daa758690ce4a84eedd5556d36cfb7ec5446b859b2f41c5f84e247da101da97b840ac1ac4e36ec53cc0c1f6aeb7b9d8a80c24a255fed3ca8505178140084e41dc924697d1f090148671b15325ad7e1b0b5eb41998c0b97a3cf4b00acad21984ed517c887bdd1754e333ef765f8f016412a9162735b207f231696bfa4dd596420f009a9149ded9da2c8a43696626937a2b86a96bc93a52c6c8f2fda99743c3d6245f3b5f2dbe9fa7a2a2d493f3c529fb323153e279ee0f9297e412dbd554707baf1a93772288c35dd8401c74f6bcae694c6fb33576ad3f4b0432390d8ebbc598c83f41049eaf46cb365a68dce7ea7447be6c2819a85ebf45cfb312574b62d25282de1e044fba9e722f3eb19daf18449f866a61780457963b137d4a7c9d2120c6ab1d017608e91b01e88c37b18c9871ef6d145b9300ac592108a1ab6a34df725da4a00dd16fef4f3ca2282bde94afc5b7630764e8256fd3bfa437a0bfd04313247cc03b11636d1806ad5f661ce21bcfcf70bbfbdf56e1df2ac7abedfdb95d9f60cf811c1db6e4426d9fa5949da60ff238712a9453b3daae8efb37c8fca17ab8814aae3e8398cc182bd4503941f37038b39bb33b42ac09e499ebf900bd62498b347abb3ee62427b44ffd3da12e9aaa24b68c94b6efe788687d99f932ffd2f5719dd6d19f7eb698060abe33f396d9d0f40ecbebf9ff6f0550b78d818139481ce6a9b9bb6d8fc806014081065fd64c5575d19d9566dc5e3359d185f655d1ad1740c0cd568bbf74f30ff750f5d7fb8547c02deab6187680ddf5e520b3203a0ba3c0e10be8154e90c5b66bc68ae353225cd0a55b054776dd5cbfd10d37e8580b0aa4cffc3cd136e8ca76a65d1beb0efccb7257403e463559aee4d1d675312e6912e9e06200398a3817ddf0428ff415d3e961dafe396d47ae9406a6fa12696ed153d37590ca06bda987a579aac1b4cc3dde8f4a5f7d8167a84abba17a85b1b6df03fac30179787d21950558522bb0a3cd65d9689a2d37fd9200a9da004ccd530bd50c231ed24b495e921534bb6bb230ef7b65b382175cfe6bdb7a20fc527e1581a314402a3bbfb9bfdf93a17f39a8428503144a1ab2d1a923d25787ef815283a751ec2cc4f7d228de65d7e477f53d506898d01be95d6189c265306fe6c4387a4221613575cb84b33f24b2fd66b85a92468835284cc4320235a83de965ad3aafd04a85ff542d6e6e54c42d21e0957acd93786554dd084b164a4631ed5711fb64de89276b5f6115188dfd1b79e7f2b6a94efdde28bcf2409cc3703bd05e6dcac4da1107649e421d6804572bd8d17272c74cb0cb1b065ca89ff49cdf39df132abf2cd9285691635400a0e203efacfb241ee264df0fffadc66d0eddc213d58a24a0b35a1d8fa40e25133bf80482b01b1f0711a243e4124007ac39b86faa9b05cfef470f594b377264c3d2ba4383f6ef02f6746ff8ea58cac4b3693d7d282686a3e8b85601dffc78510e78b0f95ce64eb660e33c4da61624f6438894026e575ac9c37396247563e0b7be67b580ce8d8cbe3829744b77ccd03187b9f269750ecc8ea67405323facd05de11f1191b7ac1c322793f994a6d54a1810dba94f2812265178e4fce6c30f3f8449ef02c24407fca2485f14c19e928ee165cb535c38027513cd9f7692171391ecb5f9c2b7ae96c18084e5913f1cd0b4c5fb6dd535e24ee04421023d36be12fc9eb709186a964c5a20e9f9b96533b3502536d8e8d61471678218d2c7b1693e5467ff2150474c2645e6bd7e9e7d84d3b0526b2ecd0991f209e30daac131a146aea17ae0001225f8bc48c206c2f8f4a415e65bc9575e60a2ca5c60ad466fa9c8fd5a904ca1dd988a5a3f32b39008eddecd0ebb9420973cc36b35c139df942554b240ce8dd774f0f6b142839e79a7e14e45418f237804fc65821981dacc0ce384dfe30abcc8a9b78590de424e9981bfb09c5fd2d6f06fe9117ffcd22eceb3b2c225b1dbe0e476cad7f516e9cc21b2253af810aaabb4dc9bcd6d8f7440afce1e614391de86f758de173126c22d78aabccdd93101e040054cd56a4cd9eb288aa3fe3bbe4cb7e7a472d75045b466f98c15d2c7fa14572357b705c0f5677c196bbfea9750b8434900e77a07f5fd3b61969d3c506440b025dc2035c163799496c2ef15baaea80e6c481b8907e4cb05448d046ff4ac18bdc8ba8b983ac2fd4d28fb6954c482d06cec571b9f6ff3ce802b33bafdfa97d09aee558e1123c043bd7f9fad10c1540870924d6c102026550e8fd1eecb229cb4ef4064e7fb0e166f21dd89cabdd5d65cad36492e3f091b6744679aa375e0059f4d2c8a0b2615a76ffea067192e6b1b7c3e80cee71c35262c7f97b17a3f993f59dee7155f67957d98b287146396409a1aa43cdcec38985527f71ef3da4dc3e249513b6577e39cf2728799501f45ddcdf4f4e58ba9bb98e71006f0212d9365126c2fd6cb01afb0e9babc1859fc057106097c3eadc4381a7baa1170952b229905f431f5a9ac0ce98f2c58ef626c28d240c33a6445b53ecad6db18a5d4e68688cfed2955c494e39668d7ace50a0c75417e01a9ecba72ae89726084c53269956b7ac4d6541410789209c5c35b894cf0aae10705edbc73973f0136172e35006405fb6af76835a84a93c2fa24be4c194045ff41289ca21854af5540aeefb9b2c6e9b099b51b6d9d0da1aff1052fd54ad23736bcc0a31e70b3a9d83c403e82a95e7426261fd11b1afa581d814cd90f578c040c7e3c5fbf0045ee907e7d5379f9beb17a437875770c890f0628a7e1575e4b2f7fd60d939d5759aab65b576f5b796203d037a31561e877f9d58355d04982a752cd602605801b2f02060f9793c610fc1297cd23c763bbb0d0bc4de8044521da6da38ea3b9c6bdcd2b455e

The key above is the one this site publishes. Its fingerprint (SHA-256 of the key) is 536f05ab a5cb2da6 21dd5ffc 524a82f1 7c6410c6 3bb0298f 6360c522 715cb3ea; the page recomputes it from the field as you edit: not computed yet. Compare it with a copy you got somewhere else before you trust a pass. Rebuilds required How many independent builders must have rebuilt this APK and got the same bytes. 0 checks who published it and not how it was built; the result says so.

02 — What it means

It catches a swapped download. It cannot vouch for the site that served it.

What a pass shows: the manifest was signed by the key in the field, your APK is byte for byte the file that manifest names, your SBOM is the one it names, and every rebuild it records agrees with your APK once its signature is taken off. So a copy from a mirror, a cache or a link somewhere else, or a damaged download, is caught the same way the command line catches it.

What it cannot show, against whoever controls this site: they could replace the APK, the manifest, the key in the field and this page together, and the page would pass. Two things narrow that, and they are yours to do. Compare the key's fingerprint with a copy from somewhere this site does not control (the source repository once it is public, and a second place we will name with the first release). And check the verifier itself: this page runs verify.wasm, 160,934 bytes, SHA-256 99d434f8 56bf3bc8 9664e102 1d0dd887 3842a166 85e515b9 eaad2863 bc527a0f (computed now from the file this page loaded: not computed yet), which bash rust/avano-verify-web/build.sh builds from a checkout or an archive of the commit that published it (on Linux, with rustup's 1.97.0 toolchain; archives of one commit built in three different directories gave the same bytes, and the build is repeated and compared every night). The command line built from that source is the strong form of this check; this page is the convenient one.

What neither shows: that the build is honest, which only independent rebuilds show; or that you were shown the same manifest as everyone else, which only a public transparency log with witnesses shows, and this verifier does not read the log. The proof page grades each of these claims on the same question.

03 — Answers

Seven answers, each with its own number.

Code	Meaning
0	Every check passed.
1	A file could not be read, or the key is not valid hex.
2	The manifest does not parse: damaged, truncated, or a format this verifier does not know.
3	The manifest was not signed by the key in the field.
4	The APK is not the file the signed manifest names.
5	The SBOM is not the one the signed manifest names, or the manifest names none.
6	A recorded rebuild disagrees with this APK, or fewer builders agree than you required.

The same numbers the command line exits with (proof, and docs/BINARY-PROOF.md in the source).