Verify

Two keys, two jobs. The release key signs the files you download. The catalog publisher key signs the catalog of models and datasets. Do not verify binaries with the catalog key.

Verify a release

Release archives ship with SHA256SUMS and SHA256SUMS.minisig, signed by the release key (minisign, key id F5D2D3C4C27D459D):

RWSdRX3CxNPS9Vl1JNjDnZ04OmM/3xrfp9vqG5FO8TNpK8Sbg6ENAI4P

Download the files you want and these three from the 0.3.1 release:
- SHA256SUMS SHA256SUMS
- SHA256SUMS.minisig SHA256SUMS.minisig
- tensorseed-release.pub tensorseed-release.pub

In the folder with the downloads, check the signature, then the checksums:

minisign -Vm SHA256SUMS -P RWSdRX3CxNPS9Vl1JNjDnZ04OmM/3xrfp9vqG5FO8TNpK8Sbg6ENAI4P
sha256sum -c --ignore-missing SHA256SUMS

The first command must report a verified signature, and the second prints OK for every file you downloaded.

Verify the catalog

Pin this publisher public key (minisign, key id CE1E0E3D543DFFB8) in catalog.publisher_pubkey. Clients reject any catalog file that is not signed by it.

RWS4/z1UPQ4ezmjrcpKqDYpqyn5h1WUS2oDs1B73Dh91kVzzNIZd03xd

Pin the Chia mainnet DataLayer store that anchors the catalog in chia.catalog_store_id. Clients accept a catalog head only when the chain anchors it.

3dcd43dced47a32f8e38e8ec77f583d8d1bafe1ab24e381538e50a36034b7a76

Client config:

[catalog]
backend = "file"
name = "tensorseed"
publisher_pubkey = "RWS4/z1UPQ4ezmjrcpKqDYpqyn5h1WUS2oDs1B73Dh91kVzzNIZd03xd"
chain_check = "strict"

[file]
base_url = "https://catalog.tensorseed.dev/"

[chia]
catalog_store_id = "3dcd43dced47a32f8e38e8ec77f583d8d1bafe1ab24e381538e50a36034b7a76"
chain_source = "light"
coin_api_urls = ["https://api.coinset.org"]

Then run tensorseed catalog chain-status, catalog info, list, show, pull, and verify. No Chia software is needed: the client checks the published chain-proof.json against a public Chia full node API.