For producers
One format across products, one verifier for everyone.
loomseal.com · For producers
One format across products, one verifier for everyone.
loomseal.com · For producers
For producers
One format across products, one verifier for everyone.
The format does not care what the claims are about. Anything a machine records in order, and somebody later has to believe, fits the same envelope.
SwitchTender emits audit bundles today. The rest are uses the format supports, not integrations that ship.
SwitchTender is the first shipping producer. The example bundle and the
seal package are the reference implementations. The chain profiles in the spec were derived from software KordLoom already
ships, so the format describes real constructions rather than hypothetical ones.
If you build software that should prove what it did, import
github.com/kordloom/loomseal/seal to sign bundles and compute chain links,
follow the bundle shape in the spec, and register your claim types through the registry.
The envelope, chain profiles, and verification stay common, so one verifier checks every producer. The format is Apache-2.0, so adopting it needs no negotiation and no permission.
Why we use it ourselves
Building on do not take our word for it, then asking you to take our word for it, is not a position we can defend.
We use it on our own products for a reason that is a little uncomfortable.
SwitchTender's promise is that it proves every change. Without a bundle that promise is a
sentence on a website, and you would simply have to believe us that the audit trail behind
it is honest. Building a company on do not take our word for it and then asking you
to take our word for it is not a position we can defend. So SwitchTender emits them.
switchtender audit bundle turns its audit chain into a signed bundle, and you
can check the claim on the box without asking us anything.
An audit log is worth exactly as much as the recipient's trust in whoever is holding it. A bundle is worth the same to a stranger as it is to your oldest customer, because checking it never involves you at all.