Q-Shield · sample signed report

A sample report. Example data, demo key.

This is what your auditor gets from Q-Shield, for Alder Biosciences, the made-up company on the Q-Shield page. No scan was run: its servers' answers were written by hand, and Q-Shield's own code turned them into the findings, the audit and the plan. Every page of the PDF says so.

It is signed the way every Q-Shield report is, with Ed25519 and ML-DSA-87, but with a demo key made for this sample, not with EpochCore's report keys.

Download

Four files.

alder-sample-report.pdf the report for an auditor (11 pages), with the check in its appendix
alder-sample-report.json the signed file behind it
alder-sample-cbom.json the CBOM (CycloneDX 1.6)
demo-keys-not-epochcore.json the demo key's public half

Check it yourself

It checks out against the demo key, and nowhere else.

Both signatures verify against the demo key. The PDF's appendix holds the OpenSSL commands and the files they need (OpenSSL 3.5 or newer), or run the open-source verifier: node src/cli.mjs verify alder-sample-report.json --keys demo-keys-not-epochcore.json.
The demo key's ids are 7B93DFD4897D6E1E (Ed25519) and 31EE547A2E8849B0 (ML-DSA-87). They are not on EpochCore's report keys page.
That is the point. Checked against EpochCore's published keys, this sample fails: "signed by a key that is not published". A real report verifies against those keys, so a report signed with any other key, like this one, can't pass for EpochCore's.

Become a design partner What Q-Shield does