Check a care report’s signature.

I sign every monthly site care report myself, as its engineer of record, with a passkey that makes me unlock it (Face ID or my passcode) each time it signs.

The signature covers a short statement. The statement names the client, the month, and a SHA-256 fingerprint of the report’s text. If one character of the report changes, the check fails.

Make a new, empty folder and download into it, from your report page, the month’s three files: report.md (the report’s text), statement.txt and statement.sig. From this page, download allowed_signers into the same folder. A fresh folder matters: a second download of the same name can arrive as report (1).md, and then you would be checking last month’s file.

OpenSSH 8.4 or later. Run ssh -V to see your version. Current Macs and Linux have it. On Windows, use Command Prompt (not PowerShell) and check ssh -V there too.

In a terminal, in the folder with the files, run:

ssh-keygen -Y verify -f allowed_signers -I [email protected] -n claphamdigital-care-report -s statement.sig < statement.txt

The same command works in Windows Command Prompt. When the statement is mine and unchanged, it prints a line that starts like this, followed by the key’s type and fingerprint:

Good "claphamdigital-care-report" signature for [email protected] with ...

Get the report’s fingerprint. On a Mac:

shasum -a 256 report.md

On Linux, sha256sum report.md. On Windows, certutil -hashfile report.md SHA256. Compare the long number it prints with the SHA-256: line in statement.txt. Capital and small letters do not matter; every other character must match.

Open statement.txt. Its Client: and Report: lines name the client and the month, and the file name I signed it as (for example 2026-10.md; on your page it is called report.md). Make sure they are yours and the month you meant. Read-check: is a number from inside the report that I read back when I signed it.

Inside report.md, the sign-off line still says “Not yet reviewed”. That is right: I sign the text as it stood before the sign-off was filled in, so that is what the fingerprint covers. The PDF on your page shows the same report with the sign-off filled.

Key fingerprint: SHA256:k7W5K5UxuJkJIHKlROxooI4LS5ZnR8BYUbl/MU9HyAA

The same key is the only one in allowed_signers.