Last updated: 24 October 2026
Two published artefacts are hashed with SHA-256: the daily brief exactly as it is served at /brief.json, and the imagery index. The manifest is chained: each one carries the SHA-256 of the previous manifest, and the chain head is signed with the operator's GPG key. You can recompute all of it.
The internal corpus (the raw feed collection behind the numbers) is not part of the chain and is not published — publishing it would expose the source list. The chain covers what you can actually fetch and check.
| Signer | Dr Parádi József CSc, operator of GridResilience |
|---|---|
| Key ID | 2E0844B46B3AC477 |
| Fingerprint | 512A 10A6 83CD DAFA A00C BECF 2E08 44B4 6B3A C477 |
| Published | keys.openpgp.org · key.asc (offline) |
| Import | curl -s https://gridresilience.eu/verify/files/key.asc | gpg --import |
Loading the signed manifest…
latest.json · latest.json.asc · index.json (the chain)
Why a brief can be newer than a manifest. The
manifest is written immediately after each brief generation, by the same pipeline. If the
brief you fetched is newer than covers_brief_generated_at, the signer is running late — the
chain-head timestamp shows it. The manifest always states which brief generation it covers, so compare
covers_brief_generated_at with the brief's own generated_at instead of treating a
newer brief as a sign of tampering.
curl -sO https://gridresilience.eu/verify/files/latest.json
curl -sO https://gridresilience.eu/verify/files/latest.json.asc
curl -sO https://gridresilience.eu/verify/files/index.json
# 1. signature: must be made by 2E0844B46B3AC477
gpg --verify latest.json.asc latest.json
# 2. the manifest is the chain head: its hash is in index.json
sha256sum latest.json
# 3. chain: prev_manifest_sha256 must equal the previous entry's hash
python3 - <<'EOF'
import json,hashlib
idx=json.load(open('index.json'))
print('chain head:', idx['entries'][-1]['manifest_sha256'])
print('prev link :', idx['entries'][-1]['prev_manifest_sha256'])
EOF
# 4. which brief generation does this manifest cover?
python3 - <<'EOF'
import json
m=json.load(open('latest.json')); b=json.load(open('brief.json'))
print('manifest covers:', m.get('covers_brief_generated_at'))
print('brief generated:', b.get('generated_at'))
EOF
If the signature verifies and the hashes line up, the published files have not been altered since they were signed — including by us.
Every delivered dossier carries an RFC 3161 trusted timestamp next to the PDF
(dossier-<reference>.pdf.tsr). The GPG signature proves who issued the file;
the timestamp proves when it existed. A third party can check both without trusting us:
openssl ts -verify -in dossier.pdf.tsr -data dossier.pdf -CAfile cacert.pem
The TSA certificate (cacert.pem) comes from the timestamp authority named in the .tsr.
A signature proves who published what; it does not make the numbers correct. The stress index is a current-state estimate, not a forecast, and the validation page lists the tests it passed and failed.