PubLedge

How to verify a record

Last updated: May 18, 2026

Every PubLedge record carries a fingerprint. Anyone can recompute that fingerprint and check it against the public manifest. If the record was altered by even one character, the fingerprints will not match. You do not need an account, special software, or to trust PubLedge. That is the point.

What the fingerprint is

A fingerprint is a SHA-256 hash: a short string of letters and numbers computed from the exact bytes of a file. Change anything in the file, even a single space, and the hash changes completely. It is not reversible and it cannot be forged. PubLedge records every canonical file's hash in one public control file, MANIFEST.yaml, at the root of the repository and the published site.

This is plain SHA-256 over plain files. It is not a blockchain, and it does not require one.

The simplest check (no command line)

1. Find the record's hash on its own page

Open the record. Its machine-readable form is published alongside it at record.json in the same folder. The record's hash is listed there and on the record page's provenance section.

2. Find the same file in the manifest

Open /MANIFEST.yaml. Each canonical file is listed with its SHA-256 hash. Locate the line for the record you are checking.

3. Compare

The two hashes must be identical. If they match, the published record is byte-for-byte the file the manifest vouches for. If they differ, the record has changed since the manifest was last signed off, and you should treat it as suspect and ask why.

Both numbers are public. Neither the operator nor anyone else can show you one value while the manifest says another, because the manifest is itself published and version-controlled.

The independent check (one command)

If you want to compute the fingerprint yourself rather than trust the value shown to you, download the record's source markdown file and run, on macOS or Linux:

shasum -a 256 us-ut-oaip-rma-2025-001.md

Compare the output to the entry in MANIFEST.yaml. Or clone the repository and run the project's own checker, which verifies every file at once:

./scripts/validate-hashes.sh

Continuous integration runs that same check on every change. A mismatch fails the build in public view.

The change history

Hashes prove a record matches the manifest now. The git history proves how it got there. Every change to every record is a public commit recording what changed, when, and by whom. Nothing is deleted: PubLedge supersedes and annotates, it never overwrites. You can read the full lineage of any record at the repository.

What this proves, and what it does not

Related