Withdraw witness

Trail 2026-09-23-fra1-lab-t3t7

T3/T7 Drain fra1-lab (Virtua Frankfurt (Kunde von AS35661)), Rückkehr nach Wartung mit echtem Verkehr und Nutzersicht

• Origin: anycast.dev/witness/2026-09-23-fra1-lab-t3t7
• Data: entries with witness.source atlas-feed or atlas-feed-t7 are RIPE Atlas measurement results (RIPE NCC, atlas.ripe.net); all other entries come from our own hosts.
• Signing key: ed25519:58334e673695e7a8, published 2026-09-23 (vor dem Lauf) at /.well-known/logsiegel-pubkey.txt
• How to check it: /.well-known/logsiegel-verify.txt (German)
• File list with sizes and SHA-256: MANIFEST.txt

Fetch and verify

BASE=https://anycast.dev/witness/2026-09-23-fra1-lab-t3t7
mkdir 2026-09-23-fra1-lab-t3t7 && cd 2026-09-23-fra1-lab-t3t7

curl -sO "$BASE/MANIFEST.txt"
curl -sO "$BASE/log.jsonl.gz"
curl -sO "$BASE/checkpoints.jsonl"
curl -sO "$BASE/origin"

mkdir -p keys anchors
curl -s -o keys/signing_key.pub "$BASE/keys/signing_key.pub"
for f in $(awk '$3 ~ /^anchors\// {print $3}' MANIFEST.txt); do
  curl -s -o "$f" "$BASE/$f"
done

gunzip -k log.jsonl.gz

# what you got is what the manifest says
awk '$1 ~ /^[0-9a-f]{64}$/ {print $1"  "$3}' MANIFEST.txt \
  | shasum -a 256 -c          # GNU: sha256sum -c

# the key comes from the published file, not from the trail
curl -s https://anycast.dev/.well-known/logsiegel-pubkey.txt -o pubkeys.txt
sed -n '/Lauf-ID: *2026-09-23-fra1-lab-t3t7$/,/END PUBLIC KEY/p' pubkeys.txt \
  | sed -n '/BEGIN PUBLIC KEY/,/END PUBLIC KEY/p' > pub.pem

pip install logsiegel==0.1.2
logsiegel verify . --pubkey pub.pem

Expected: PASS: <N> entries, <M> checkpoints. The guide also shows how to break the check on purpose, so you know it measures something.

The copy of the public key inside the trail (keys/signing_key.pub) proves nothing against us — whoever controls the directory can rewrite log and key together. Take the key from the published file.

Files

Unpacked, log.jsonl is 28,039,805 bytes, SHA-256 9b37004e6705efd5b830b379f62d438c21a79e1e1fc5992852f98e7ea767c2c1. Unpacking changes nothing about the proof.

13 RFC 3161 timestamp tokens are in anchors/; each one stamps a signed checkpoint root. The certificates to check them against: digicert-root-g4.pem, digicert-chain.pem — or your own system trust store, the result must be the same.

All runs