GOVP
Source
GOVP-1 stable · verifier 0.1.11

Sign once. Verify anywhere.

GOVP places a readable Ed25519-signed record beside any digital artifact. Recipients verify the signature and exact bytes locally, without an account, a central API or a proprietary verifier.

Start with GOVPRead the specification

Open protocol · stewarded by Gemacode

LOCAL VERIFICATION
record.govp.txtVersion: GOVP-1
Signature: Ed25519
Asset-SHA256: 2e6870bc…
bound to exact bytes
artifact.binSHA-256: 2e6870bc…
VALIDformat · signature · govp-id · asset
Portable verification

A record that keeps working after the artifact travels

The publisher signs once. The record and artifact can be mirrored, archived or delivered by any channel. Verification remains local and implementation-independent.

Sign a portable GOVP record, distribute it beside an artifact, then verify both locally.
  1. 01 · SignPublisher

    Signs a readable GOVP record for the exact artifact bytes.

  2. 02 · DistributeRecord + artifact

    Travel through mirrors, archives, email or independent systems.

  3. 03 · VerifyAny recipient

    Checks signature and integrity locally, with no GOVP account.

Portable

A self-contained record

The public key travels with the record. No GOVP account or central service is required.

Deterministic

Byte-exact verification

The frozen signing input and conformance vectors make implementations comparable across runtimes.

Bounded

Cryptographic evidence

GOVP proves signature and integrity. It does not claim that the signed statement is true.

Composable by design

Keep the evidence stack you already trust

GOVP can bind SCITT receipts, COSE messages, DSSE envelopes, in-toto attestations and Sigstore bundles as exact upstream evidence objects. Their native verifiers still decide their internal validity; GOVP keeps the verified bytes portable.

See the layered verification model →

Separate, cumulative verdicts

GOVP valid confirms the GOVP record and exact byte binding. Upstream valid confirms the source signature, receipt, attestation or transparency proof. Application policy decides whether both are sufficient.

Public foundation

One protocol, independent implementations

The specification, schema, conformance vectors, Python reference implementation and JavaScript verifier are public under Apache-2.0.

Explore the documentation →
# Python reference implementation
python -m pip install govp==0.1.11
govp self-test
govp conformance --run
govp verify-url https://govp.io/.well-known/govp.txt

# JavaScript verifier
npm install @govp/verifier@0.1.8