Portable Cryptographic Proof.
Proof Envelope is an open specification for packaging, signing, and verifying cryptographic assertions across software, identity, licensing, and compliance.
- ├─License Statementtype: license
- ├─Provenance Statementtype: slsa.provenance
- ├─SBOM Statementtype: sbom.cyclonedx
- ├─Identity Statementtype: identity
- ├─Custom Statementstype: your.domain.*
Trust infrastructure, designed to travel.
Move proofs between systems without relying on a central server.
Verify assertions cryptographically and offline.
Define custom statement types for any domain.
Bundle multiple independent proofs into a single envelope.
From issuer to offline verifier in six steps.
Every envelope is a self-contained artifact. No phone-home, no vendor dependency — the verifier holds everything it needs.
- 01Issuer
An authority with signing keys.
- 02Creates Statements
Typed assertions about a subject.
- 03Packages Envelope
One or more statements bundled together.
- 04Signs Envelope
Detached signature over the canonical payload.
- 05Distributes Artifact
Ship with the build, embed, or hand off.
- 06verifiedVerifier Validates Offline
No network, no central server.
One envelope. Many domains of trust.
Per-seat, per-tier, per-feature entitlements verifiable in your runtime.
Sign and ship attestations alongside every build artifact.
Package CycloneDX or SPDX SBOMs as signed, portable evidence.
Carry SLSA provenance with the artifact, not in a remote ledger.
Issue and present verifiable identity assertions, offline.
Auditor-checkable claims with cryptographic guarantees.
Transferable, signed proofs of ownership and entitlement.
A neutral envelope format every internal system can speak.
Five primitives. Nothing magical underneath.
Proof Envelope keeps the surface area small on purpose. The whole model fits on a napkin — and that's the point.
A signed envelope, in plain JSON.
Statements are typed payloads. The envelope wraps them, the signature seals them, the verifier checks them — anywhere.
{
"envelopeVersion": "1.0",
"id": "urn:pe:9f4a…c2e1",
"issuer": "did:web:sigil.dev",
"issuedAt": "2026-05-31T12:00:00Z",
"statements": [
{
"type": "license",
"subject": "elsa-enterprise",
"issuer": "sigil"
}
],
"signature": {
"alg": "ed25519",
"value": "MEUCIQD…"
}
}import { verify } from "@proofenvelope/verify";
// load the envelope from disk, wire, or vault
const envelope = await fetch(".pe/envelope.json")
.then(r => r.json());
// fully offline — no network, no central server
const result = verify(envelope, {
trust: ["did:web:sigil.dev"],
});
if (result.valid) {
for (const s of result.statements) {
unlock(s);
}
}
Shipping in the open.
- ✓Envelope Format
- ✓Statement Model
- ✓Offline Verification
- ✓.NET SDK
- ○Reference Verifier
- ○Additional SDKs (TypeScript, Rust, Go)
- ○Registry Specification
- ○Community Statement Types
Designed as an open specification that anyone can implement.
Proof Envelope is governed in the open, MIT/Apache licensed, and built to outlive any single vendor — including the one stewarding it.