Coming Soon
Coming Soon
Every vault release VettID runs: what it is, what changed, and how long it keeps running.
No production release has been published yet. The first release will appear here, and in the signed manifest, when the vault opens to members.
VettID will list every vault release it runs in a signed manifest at https://vettid.org/.well-known/vettid/pcr-manifest.json. The manifest is published at that address with the first production release; until then there is none, and nothing is served there. Your app will verify its signature with a key built into the app, and your vault will only open in the release you approved. This log is generated from that manifest, so the two cannot disagree; once it is published, the manifest's history will be public in the vettid.org repository.
Releases are built reproducibly from the public vettid-vault source. Anyone can rebuild a release from its tag and compare the measurement (PCR0) with the one listed here: how to rebuild and match.
What the statuses mean, and how long each release keeps running, is explained in Vault release updates: a release is kept for at least 12 months after a newer one replaces it, the last 90 days with a final notice and emails, then it ends. The first release, which goes to a small group of testers, is the exception: it is kept for 90 days after release 2 replaces it.