moonrock

Transparency log

Every listing, check, endorsement and removal, including the ones done by the moderator.

Each event's hash covers the previous event's hash, so changing or deleting a past event breaks every hash after it. Save the current head somewhere: if it ever stops being part of the chain, the log was rewritten.

Current head, signed by tctdx's key just now. Save it: the signature proves what the log looked like at that moment.

moonrock-log-head-v1 14 716965284b69256bf531e8975f27d93d2fc6954db8252fd0b5954d442d3e1214 1794579574858 LW6jlbK7QPtTBml0u40kLYxJHFc3m_s-8qDsHBWxb08AaVeAn5RH6LSHgfHJ4fusu0bmMU8YwgaFbgQ_E06nDw

The chain covers each URL's hash, not the URL itself, so an address can be redacted on request without breaking it.

Verify it yourself

Run this in a terminal. It recomputes every hash, then checks the operator's signature on the head. The full log is at /api/log (paginated with after).

# Recompute the whole chain, then check the operator's signature on its head.
# Needs curl, jq, shasum and OpenSSL 3 or newer (macOS's built-in openssl is too old: use Homebrew's).
log=$(curl -s "https://moonrock.sh/api/log?limit=1000")
prev=$(printf '0%.0s' $(seq 64))
while IFS=$'\x1f' read -r seq ts type id url_hash detail p hash; do
  calc=$(printf '%s\n%s\n%s\n%s\n%s\n%s\n%s' "$prev" "$seq" "$ts" "$type" "$id" "$url_hash" "$detail" | shasum -a 256 | cut -d' ' -f1)
  [ "$p" = "$prev" ] && [ "$calc" = "$hash" ] || { echo "chain broken at #$seq"; break; }
  prev=$calc
done < <(printf %s "$log" | jq -r '.events[] | [.seq, .ts, .type, .site_id, .url_hash, .detail, .prev, .hash] | map(tostring) | join("\u001f")')
[ "$prev" = "$(printf %s "$log" | jq -r .head.hash)" ] && echo "chain ok, head $prev"

b64d() { local s; s=$(printf %s "$1" | tr '_-' '/+'); while [ $((${#s} % 4)) -ne 0 ]; do s="$s="; done; printf %s "$s" | openssl base64 -d -A; }
tmp=$(mktemp -d)
{ printf '\x30\x2a\x30\x05\x06\x03\x2b\x65\x70\x03\x21\x00'; b64d "$(printf %s "$log" | jq -r .head.operator_key)"; } | openssl pkey -pubin -inform DER -out "$tmp/key.pem"
b64d "$(printf %s "$log" | jq -r .head.signature)" > "$tmp/sig"
printf %s "$log" | jq -j '.head | "moonrock-log-head-v1\n\(.seq)\n\(.hash)\n\(.ts)"' > "$tmp/msg"
openssl pkeyutl -verify -pubin -inkey "$tmp/key.pem" -rawin -in "$tmp/msg" -sigfile "$tmp/sig"

Latest events

showing 14