plexoria
Trust

Verify a bundle

Every Plexoria dataset is a signed bundle. Two checks prove it is intact and really from us — no account or API needed, just the files and this page.

What's in the bundle

Alongside the data and datasheet, each bundle carries manifest.json (SHA-256 of every file + signer identity), manifest.sig (an Ed25519 signature over the manifest), and public_key.pem (the public half of the signing key).

Step 1 — anchor the key

Confirm the bundle's public key is genuinely ours by matching its fingerprint to the one published here, out-of-band:

# fingerprint published at plexoria.io/keys.txt
shasum -a 256 public_key.pem
e6674069396a79a2295ec2c64ed5f39b81f7e270f69d78e0a0e8e371fcf65665  public_key.pem

Step 2 — verify signature + hashes

This checks the Ed25519 signature over the manifest, then that every file's SHA-256 still matches — i.e. nothing was altered or swapped:

python - <<'PY'
import json, hashlib, pathlib
from cryptography.hazmat.primitives.serialization import load_pem_public_key
d = pathlib.Path(".")
pub = load_pem_public_key((d/"public_key.pem").read_bytes())
sig = bytes.fromhex((d/"manifest.sig").read_text().strip())
pub.verify(sig, (d/"manifest.json").read_bytes())          # raises if invalid
m = json.loads((d/"manifest.json").read_text())
for name, want in m["files"].items():
    got = hashlib.sha256((d/name).read_bytes()).hexdigest()
    assert got == want, name
print("OK — signature valid, all file hashes match")
PY
The in-bundle key proves integrity. Anchoring its fingerprint here (and on our marketplace profile) is what proves authenticity — that the key is Plexoria's, not an impostor's. Always do Step 1.

The signing key

Public key and fingerprint, also served as plain text at plexoria.io/keys.txt:

SHA-256  e6674069396a79a2295ec2c64ed5f39b81f7e270f69d78e0a0e8e371fcf65665

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAL3lTFojHNEMFvcX1WYuKdzdiKzlsibSqKaUlbHK5tvM=
-----END PUBLIC KEY-----

The private key never leaves its owner and is never in any bundle or repository. Only the public key above is distributed.