Audit Evidence¶
The evidence store is one hash chain of signed records. These pages cover how its history is protected (anchors), how long it is kept and archived, how a period of it is packed for an audit, and how an auditor verifies a pack from keys and anchors the auditor holds.
All of it needs the evidence store (EVIDENCE_STORE=on), which is off by
default.
Signed store anchors, and how an auditor keeps copies that show whether anything was removed from the evidence store.
What is kept, for how long, and why nothing is pruned before it is archived to immutable storage and read back.
One period of the evidence store, with everything its records cite, a report for auditors and a manifest the NA signs.
genesis-mesh audit verify: from the root key and the anchors you hold, and
the completeness check against a log kept outside Genesis Mesh.
genesis-mesh-verify, a Rust port of the reference verifier: what it
checks, what a second verifier does and does not catch, and how to rebuild
it.
A recorded run: write a pack, verify it with both verifiers, and see a missing change and a changed file fail.