What is an Offline Verifier?
An Offline Verifier is a deterministic program that validates evidence bundles without any network dependency, producing consistent PASS, PASS_WITH_CAVEATS, or FAIL verdicts.
Key Properties
- ■No Network: Operates entirely offline; no API calls or external lookups
- ■Deterministic: Same bundle bytes always produce identical verdict
- ■Auditable: Simple, readable code that can be reviewed and audited
- ■Portable: Runs on any platform with minimal dependencies
Why It Matters
Offline verification removes trust dependencies. Instead of trusting the bundle producer or a remote verification service, auditors trust only the verifier code and cryptographic primitives.
This enables verification in air-gapped environments, ensures vendor independence, and allows multiple parties to independently verify the same bundle.
Verdict Types
PASS
All checks succeeded. Bundle is valid.
PASS_WITH_CAVEATS
Cryptographic checks passed, but optional
features degraded (e.g., local timestamps).
FAIL
One or more checks failed. Bundle should
not be trusted. Error code identifies issue.
Example output:
{
"verdict": "PASS",
"report_hash": "sha256:...",
"checks": {
"manifest": "OK",
"policy": "OK",
"receipts": "OK (42/42)",
"chain": "OK"
}
}