Why can't I check verdict.signature myself?

Q: Why can't I check verdict.signature myself?

verdict.signature covers data that is not in the public response, so you can't rebuild what was signed. Check the receipt instead. It was built to be checked by anyone, and it covers the verdict through verdictHash .

verdict.signature covers data that is not in the public response, so you can't rebuild what was signed. Check the receipt instead. It was built to be checked by anyone, and it covers the verdict through verdictHash.

Last updated November 9, 2026

What to check

The receipt's Ed25519 signature, with the public key from /.well-known/jwks.json.
That verdictHash matches the public verdict. On 1.1.0 receipts that covers the coarse result and a digest of the named signals, so anyone can run it, free accounts included. 1.0.0 receipts are hashed over the whole stored verdict, which the public lookup no longer shows, so the server check (verified) confirms them.

See How to check a ClearRun receipt signature yourself.

What verdict.signature is good for

Showing a verdict came from ClearRun's hosted service and not mock mode. Hosted verdicts always have one.