Documentation

Verifier usage and export formats.

Verifier

Core51 Evidence Verifier (Python)

The verifier checks export integrity, validates message chains and signatures (best-effort), and can decrypt v2 messages. It can also decrypt file attachments on demand (download only when requested).

Download

core51-evidence-verifier-src.zip

Tip: the verifier prints its version as the first line at startup.

Install (Windows)

python -m pip install -r requirements.txt
python verify_evidence_zip.py --help

Install (Linux/macOS)

python3 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt
python verify_evidence_zip.py --help

Command reference

Verify only

python verify_evidence_zip.py chat.zip

Checks manifest + sha256, parses messages, validates hash-chain. Signature verification may be WARN if historical keys are missing or if legacy fields were not exported.

Verify + decrypt messages (v2)

python verify_evidence_zip.py --decrypt chat_v2.zip

Enter the encryption private key (base64, 32 bytes). Decryption is best-effort: only messages with stored envelopes can be decrypted.

Print decrypted transcript (stdout)

python verify_evidence_zip.py --decrypt --print-decrypted chat_v2.zip

Shows Core ID (public_id) when available. If the plaintext is an attachment message, the verifier prints ATTACHMENT_ID to copy/paste.

Export readable package (tamper-evident)

python verify_evidence_zip.py --decrypt --export-readable out_readable.zip chat_v2.zip

Creates a ZIP with report + transcript and includes the original input ZIP for reproducibility.

Fetch + decrypt one attachment (on demand)

python verify_evidence_zip.py --decrypt chat_v2.zip \
  --bearer-token "<JWT>" \
  --fetch-attachment "<ATTACHMENT_ID>"

The verifier calls /api/attachments/<id> with Authorization: Bearer, downloads ciphertext from R2 via a presigned URL, verifies sha256, and decrypts locally.

Note: for tests the token is passed via CLI (visible in shell history). For production, we recommend reading it from stdin or an environment variable.

Export formats

v2 export endpoints

GET /api/chats/{chat_id}/wire-export.v2
GET /api/chats/{chat_id}/wire-export.v2.zip

v2 exports are required for decryption because they include key envelopes.

What is verified

File integrity: SHA-256 of users_keys.json and wire_messages.jsonl matches manifest.json.
Chain integrity: per-conversation hash-chain is consistent (payload_hash_b64 ↔ prev_payload_hash_b64).
Signature: Ed25519 signature is checked best-effort. Newer exports include rotation-proof pubkey-at-send and signed prev, reducing WARNs.
Decryption: v2 messages are decrypted locally using envelopes (crypto_box_v1) and AES-256-GCM.

Support Terms & Conditions Company