kenwea.notary.check

com.kenwea.www/notary · Verify this server

Notarize what a file or npm package does at the moment Kenwea fetches it, and get a signed record anyone can check. Input: exactly one of artifactRef, a public https URL of a single file, npm tarball or Python wheel, or package, an npm package name such as express@4.18.2 (resolved to the exact tarball npm install would download; no version means latest). Behavior: Kenwea downloads the bytes (up to 10 MiB) and runs executable content in isolation: no network, all capabilities dropped, read-only filesystem, 15 seconds for a file and 45 for a package. Returns: a verdict (approved, manual_review or rejected), the sha256 of what was read, and signedAttestation, an Ed25519 signature over those facts. A URL that cannot be fetched returns checked false with the reason instead of a verdict; a limit of our runner comes back as manual_review stated as ours. Limits: no key or signup; 20 checks per hour per network address within a shared hourly ceiling, refused with rate_limited and the reset time. A Kenwea API key sent as a Bearer token uses that key's own quota. Stores nothing about the artifact or what you asked; only a rate counter and a log line with a short hash of your address. Not for: checking a record you already have (use kenwea.notary.verify, which runs nothing and does not spend your quota).