Signing Keys

1. Which records are signed

• LedgerSeal: the attestation of each seal. It is the issue property ledgerseal-cert, and it is also in the evidence record that you copy from the Approval Seal panel. It holds the snapshot hash, the certificate id and the seal status.
• DefinitionGuard: the issue property definitionguard-dod, the summary of the issue's Definition of Done checklist.

The algorithm is Ed25519 (RFC 8032). Each signed record names its key id in the field keyId. The public keys below are in SPKI PEM format.

2. What a signature shows

A valid signature shows that the record came from the app that holds the key, and that the record was not changed after it was signed. Asymm Systems holds the private keys. So a signature does not protect against Asymm Systems: someone who holds the private key can sign a new record.

3. Production keys (production: the Marketplace apps)

These keys sign records made by the Marketplace apps (the Forge production environment). Accept a record as production evidence only when it is signed with one of these keys.

ls-prod-2026-11 (LedgerSeal, production: the Marketplace app)

• Key id: ls-prod-2026-11
• SHA-256 fingerprint (of the DER public key): 09f2b807adc803a7f687e0561e90b8dcadadd6c1d752c66b55980a27b89cc5d3
• File: keys/ls-prod-2026-11.pub.pem in the open verifier repository (from release v1.3.0).

dg-prod-2026-11 (DefinitionGuard, production: the Marketplace app)

• Key id: dg-prod-2026-11
• SHA-256 fingerprint (of the DER public key): 956589daeeb464de4dd4a3c04659c494d2e2b31e4fc9a06784704539ce91f9fb

4. Development keys (development builds only)

These keys sign records made by development builds of the apps. They are not used by a Marketplace installation. Do not accept a record signed with one of these keys as production evidence.

ls-dev-2026-11 (LedgerSeal, development builds only)

• Key id: ls-dev-2026-11
• SHA-256 fingerprint (of the DER public key): cecef4ee9d75298c9107ede72389edd5be59562027363aca90092b70b8c7d283
• File: keys/ls-dev-2026-11.pub.pem in the open verifier repository.

dg-dev-2026-11 (DefinitionGuard, development builds only)

• Key id: dg-dev-2026-11
• SHA-256 fingerprint (of the DER public key): 7e6d8e01ba08f8ee2f81062efd1a76764c577c41bb8694e9010d7ea34e4373d5

To check a fingerprint, save the PEM text as a file and run:

5. Checking LedgerSeal evidence

The open verifier checks a LedgerSeal evidence record offline, with no access to Jira or to LedgerSeal. It is in the public repository asymmsystems/jira-governance-code-cli (Apache-2.0), release v1.3.0, and needs Node.js 18 or later.

1. In the Approval Seal panel, open the seal details and click Show evidence (JSON). Copy the text into a file, for example evidence.json.
2. Download the verifier release and open a terminal in its folder.
3. Run node verify-evidence.mjs evidence.json. The verifier reads the key named by the evidence from its keys/ folder. To use a key from this page, save it as a file and give it as the second argument: node verify-evidence.mjs evidence.json key.pem.
4. Each of the five check lines must start with PASS, and the exit code must be 0. A NOTE line names a redaction entry; it is not a failure.

The Open Verifier guide lists the five checks and what a pass shows.