Elysia Tools
Navigation
Workflow Playbook
Generate or reproduce a file hash, compare it with a published checksum, and verify a detached Ed25519 signature with a separately trusted public key.
Hubs
This workflow is for release engineers, security reviewers, and operations teams who receive a known file with a published digest and a detached signature. Keep an untouched copy, record where it came from, and capture the expected algorithm, checksum, signature encoding, and public-key fingerprint before running a tool.
Use file-hash-verifier to calculate a digest over the exact file bytes. If the signature covers a canonical text manifest or another explicit message, use hash-generator only for that exact representation. These results live in different domains unless the signing specification says otherwise.
Use checksum-comparator to compare the local digest with the publisher's checksum. A match is useful byte-level evidence, but it does not prove the publisher authored the file. The checksum source must itself be trusted.
Use ed25519-x25519-keygen-signature-verifier in verification mode with the exact signed message, detached signature, and public key. Preserve the encoding and serialization used at signing time. A false result can come from changed bytes or formatting; a true result still requires a separate decision that the public-key fingerprint belongs to the expected signer.
Finish with three explicit fields: file integrity result, signature result, and public-key trust result. Accept only when the expected digest matches, the signature validates over the intended payload, and the key was confirmed through the approved channel. If any field is unknown or fails, mark the artifact for review instead of converting partial evidence into a provenance claim.
Workflow playbook
Use the unchanged file and the algorithm named by the publisher. Record the calculated digest, file name, size, and any expected value without editing the artifact between acquisition and hashing.
If the signed object is canonical text, a manifest, or a digest string rather than a direct file upload, reproduce that exact representation and calculate its digest with the declared encoding. Do not assume this text digest is interchangeable with the file-byte digest.
Compare the locally calculated value with the independently supplied checksum, confirming that both values use the same algorithm and refer to the same artifact. Preserve the mismatch details if they differ.
Pass the exact signed message representation, detached signature, and public key to verification. Record the boolean result and separately confirm that the key fingerprint came from a trusted channel; a valid signature under an untrusted key is not an accepted provenance result.
A matching hash shows that the checked bytes agree with a reference digest. It does not establish who produced the file. A signature can support signer authenticity only when the exact signed payload and the public-key trust decision are both correct.
Determine whether the signature covers raw file bytes, canonical text, a manifest, or a digest string. Verify that same representation; changing line endings, encoding, whitespace, or serialization can produce a valid-looking but irrelevant check.
Use the algorithm named by the publisher and compare values only after normalizing case and presentation without changing the underlying digest. Do not turn a different algorithm or a copied value into a pass result.