Verify an AER bundle

Paste any AER ID below. Your browser fetches the canonical bundle, downloads the public signing key, recomputes the hash and verifies the Ed25519 signature locally, then checks the Rekor transparency-log inclusion proof against pinned keys. No AER server-side trust is required. This is the same verification the aer verify CLI performs.

Don't have one?

Equivalent offline checks, no AER server trust required:

With the CLI:

AER_BASE_URL=https://api.aer.run \
  pnpm --filter @aer/cli exec tsx src/main.ts verify <aer-id>

With curl + sha256sum + openssl (POSIX shell):

# 1. Download the canonical bundle
curl -s https://api.aer.run/v1/aers/<aer-id>/bundle > bundle.json

# 2. Strip the integrity block, canonicalise, hash
jq -cS 'del(.integrity)' bundle.json | tr -d '\n' > canonical.json
sha256sum canonical.json
# → should match bundle.integrity.hash

# 3. Fetch the public key
KEY_ID=$(jq -r .integrity.signing_key_id bundle.json)
curl -s https://api.aer.run/v1/keys/$KEY_ID | jq -r .public_key_pem > key.pem

# 4. Verify the signature with openssl
jq -r .integrity.hash bundle.json | xxd -r -p > hash.bin
jq -r .integrity.signature bundle.json | base64 -d > sig.bin
openssl pkeyutl -verify -pubin -inkey key.pem -rawin -in hash.bin -sigfile sig.bin
# → 'Signature Verified Successfully'