How to read the signature fields on a ClearRun verdict
Hosted verdicts carry signature, signatureKeyId and signatureAlg. They show ClearRun signed the verdict. Mock verdicts have all three set to null.
Last updated
The fields
| Field | Hosted | Mock |
|---|---|---|
signature | A signature string | null |
signatureKeyId | Id of the signing key | null |
signatureAlg | ed25519 | null |
Can I check it?
Not on its own. It covers data that is not in the public response. To check a score yourself, check the receipt. See Why can't I check verdict.signature myself?
A quick test in code
const isSigned = typeof verdict.signature === 'string' && verdict.signature.length > 0;ClearRun never returns an unsigned hosted verdict. If signing fails, the call returns 500 UNSIGNED_VERDICT.