ProtocolPlatformsUse casesDocsTrust modelVerifyAll docs
Docs · Quickstart

GOVP in five minutes.

Three ways to start, depending on where your records live. The fastest is the browser — you can verify a real record before you finish reading this sentence.

Browser
Verify · no install
WordPress
Issue · publish
GOVP CLI · v0.1
Install · verify · inspect
Track A · Browser

Verify a record — nothing to install

The full GOVP-1 check, including the Ed25519 signature, runs in your browser. Nothing is uploaded.

  1. Open the verifier
    Go to the public verification portal.
  2. Load a real sample
    Click Load a real sample (or paste any .govp.txt record).
  3. Verify
    Press Verify record. You get a deterministic PASS with the checks that ran.
  4. Break a byte
    Change one character and verify again — it fails for everyone, everywhere. That is the whole point.

Want a record to try? Download one from the use cases or the reference library — every example passes.

Track B · WordPress

Issue evidence from a WordPress site

The reference plugin turns any WordPress site into a GOVP issuer and verifier — pure PHP (libsodium), no sidecar. Requires PHP 7.4+ with ext/sodium and ext/dom.

  1. Install & activate the plugin
    Download GOVP Public Evidence 2.38.2, upload the ZIP from Plugins → Add Plugin → Upload Plugin, and activate it.
  2. Generate the site signing key
    In GOVP → generate key. Then confirm the built-in self-test reports CONFORME — it proves your install verifies byte-for-byte like the reference implementations.
  3. Certify a post or page
    In the editor, open the GOVP panel → Certify. The declaration is fixed into a GOVP-1 record.
    # show the verifier anywhere with a shortcode [govp_verify id="GOVP-DOC-xxxxxxxxxxxx"]
  4. Route .well-known to WordPress
    The one host-dependent step: make sure requests reach PHP so the identity and records are served.
    # Nginx — inside server { }, before any static .well-known block location ^~ /.well-known/govp { try_files $uri $uri/ /index.php?$args; }
    # check it serves GOVP, not a 404 curl -s https://your-site/.well-known/govp.txt curl -s https://your-site/.well-known/govp/index.json

Production key safety. Keep the signing key out of the web root. In a production environment the plugin blocks issuing if the key sits under the web root (verification still works). Set a safe path, or sign with a KMS/HSM — see the integration guide.

Track C · CLI & self-host

Install the reference CLI

The installer selects the correct macOS or Linux binary, downloads it from govp.io, verifies its published SHA-256 and runs the built-in conformance self-test.

  1. Install GOVP v0.1.2
    No Python or package manager is required. Review the script first if your environment requires it.
    curl -fsSL https://govp.io/install.sh | sh govp installed at /usr/local/bin/govp
  2. Or install with pip
    The release wheel is hosted by the protocol domain while the source repository completes its final private review.
    python -m pip install https://govp.io/downloads/python/v0.1.2/govp-0.1.2-py3-none-any.whl govp self-test
  3. Run the conformance self-test
    Both installation paths contain the same deterministic checks used by the public vectors.
    govp self-test GOVP self-test: PASS
  4. Verify a record and its original file
    The CLI checks format, Ed25519 signature, derived GOVP-ID and the optional artifact SHA-256 locally.
    govp verify record.govp.txt --asset original.pdf GOVP verification: VALID format pass signature pass govp-id pass asset pass
  5. Inspect or verify from a URL
    Machine-readable JSON output and deterministic signing inputs make the command usable in CI and audit scripts.
    govp verify-url https://example.org/.well-known/govp.txt govp inspect record.govp.txt govp verify record.govp.txt --json

Release binaries and SHA256SUMS are served by the protocol domain. Source repositories remain private during the final review and can be opened without changing the installation URL.

Next: worked examples Integration guide
← GOVP