Changes to “Checking a downloaded file”
#94 (zoobc.how, 2026-10-26 20:39 UTC) → #1091 (zoobc.how, 2026-10-27 00:42 UTC): Seed article updated
…
The chain holds hashes in two places:
+ - **The release registry.** The release authority, an account named in the chain's genesis, registers each release with its version string and a 32-byte manifest hash, and may later revoke it. Single files are listed too: the wallet, the explorer and the address files each have their own hash, and a bundle's entry is the SHA-256 of its SHA256SUMS file. Two thirds of the registered seats can also veto a release, and replace the authority after a week of votes ([[releases-and-updates]]).
− - **The release registry.** The release authority, an account named in the chain's genesis, registers each release with its version string and a 32-byte manifest hash, and may later revoke it. Two thirds of the registered seats can also veto a release, and replace the authority after a week of votes ([[releases-and-updates]]).
- **Transaction messages.** Any transaction can carry a hash in its message, and the hash can be searched for.
…
1. computes the SHA-256 hash inside your browser; the file is never uploaded;
2. looks the hash up in the release list (`/api/v1/release/list`) and in transaction messages (`/api/v1/search/transactions?q=` followed by the hash);
+ 3. reports one of three statuses: **on-chain** when the hash is registered on the chain; **anchor pending** when the file is meant to have chain backing but its hash is not registered, so only the gateway vouches for it; **revoked** when the release authority has withdrawn it.
− 3. reports one of three statuses: on-chain, anchor pending or revoked.
When it loads, the page also reads the current release authority (`/api/v1/release/authority`) and warns you when a change of authority is pending. A revoked file is one that was withdrawn; delete it.
…
```
+ If the hash you computed is listed for a release that has not been revoked, you hold the released file. For a bundle, check the hash of its SHA256SUMS file against the list, then run `sha256sum -c SHA256SUMS` beside the bundle's files. Every node answers from the same chain, so no single website has to be trusted.
− If the hash you computed is listed for a release that has not been revoked, you hold the released file. Every node answers from the same chain, so no single website has to be trusted.
## What the gateway publishes
…