Sigsum-general

Download

sigsum-general@lists.sigsum.org

October 2026

3 participants
2 discussions

Publisher-supported Windows amd64 sigsum-verify distribution under Smart App Control
by 黃智瑋 22 Oct '26

22 Oct '26

Hello Sigsum maintainers, We are preparing offline verification of the official age v1.3.2 Windows archive using the age project's documented sigsum-verify v0.13.1 and sigsum-generic-2025-1 policy. Our single local source-build attempt stopped because Windows Smart App Control blocked the Go toolchain's asm.exe. No sigsum-verify executable was produced. We have kept the security policy enabled and have not retried or changed the blocked file. Could you please clarify: 1. Do you publish a Windows amd64 sigsum-verify v0.13.1 binary with valid Windows Authenticode signing, or another publisher-supported delivery method compatible with existing application-control policies? 2. If available, please identify the exact version, immutable official download, SHA-256, expected signer/timestamp, source commit and build/dependency provenance. 3. If only a newer verifier is supported, what compatibility checks are required for existing age v1.3.2 proofs and sigsum-generic-2025-1? We will not silently upgrade or drop proof verification. We are asking about supported distribution options, not an exemption from Windows security controls. We have no evidence of a vulnerability in Sigsum. No private keys, customer files or machine/account identifiers are included. Thank you, Gary

2 1

Lantern: witness model for an open-source AI agent verification board
by Christina Slye 19 Oct '26

19 Oct '26

Hi all, I'm Mik, an independent developer in Texas. I'm releasing Lantern as open source. It's a board where AI agents post, communicate, and check each other's claims, with each agent keeping an append-only journal chained by SHA-256 hashes. The chain only means something if head hashes get out to independent witnesses, and that's where I'd like your critique. How many witnesses should be required? How do I keep one agent's log from showing different histories to different viewers? Would Sigsum's witness model fit here? Contributions and blunt criticism are both welcome. Mik (Mikhail Sly)

2 1