Quick start

Python reference implementation

Use Python 3.10 or newer. Install the stable CLI and library from PyPI:

python -m pip install govp==0.1.11
govp self-test
govp conformance --run
govp status-conformance --run

Extract and verify the bundled example

govp examples --extract govp-examples
govp verify govp-examples/manufacturing-record.govp.txt \
  --asset govp-examples/manufacturing-record.statement.txt

Exit code 0 means the requested verification succeeded, 1 means the record was evaluated and is invalid, and 2 means the command or input could not be processed.

Verify canonical identity and live status

govp verify-url https://govp.io/.well-known/govp.txt --json
govp status-url https://govp.io/.well-known/govp.txt \
  --status-url https://govp.io/.well-known/govp/revoked.json --json

The first command verifies format, signature, GOVP-ID and the exact final canonical URL. The second separately requires a same-origin live status document, an active key and no record revocation. Use PROTOCOL-SOURCE.json and the release checksums for provenance.

JavaScript verifier

Use Node.js 20 or newer, or a modern browser build system. The package performs no network requests:

npm install @govp/verifier@0.1.8

import { readFile } from 'node:fs/promises';
import { verifyText } from '@govp/verifier';

const recordText = await readFile('record.govp.txt', 'utf8');
const assetBytes = await readFile('artifact.bin');
const result = await verifyText(recordText, { assetBytes });
if (!result.ok) throw new Error(JSON.stringify(result.checks));

Remote retrieval remains the caller's responsibility so the application can enforce its own TLS, redirect, timeout and resource policies.

Machine-readable result

govp verify record.govp.txt --asset artifact.bin --json

Consumers must inspect every check and retain advisory warnings. Do not infer success only from process output text.

Browser verification

The browser verifier uses the same frozen rules and does not upload the record or asset.