ProtocolPlatformsUse casesDocsTrust modelVerifyAll docs
Docs · Quickstart

GOVP in five minutes.

Three ways to start, depending on where your records live. The fastest is the browser — you can verify a real record before you finish reading this sentence.

Browser
Verify · no install
WordPress
Issue · publish
GOVP CLI · v0.1
Install · verify · inspect
Track A · Browser

Verify a record — nothing to install

The full GOVP-1 check, including the Ed25519 signature, runs in your browser. Nothing is uploaded.

  1. Open the verifier
    Go to the public verification portal.
  2. Load a real sample
    Click Load a real sample (or paste any .govp.txt record).
  3. Verify
    Press Verify record. You get a deterministic PASS with the checks that ran.
  4. Break a byte
    Change one character and verify again — it fails for everyone, everywhere. That is the whole point.

Want a record to try? Download one from the use cases or the reference library — every example passes.

Track B · WordPress

Issue evidence from a WordPress site

The reference plugin turns any WordPress site into a GOVP issuer and verifier — pure PHP (libsodium), no sidecar. Requires PHP 7.4+ with ext/sodium and ext/dom.

  1. Install & activate the plugin
    Download GOVP Public Evidence 2.38.2, upload the ZIP from Plugins → Add Plugin → Upload Plugin, and activate it.
  2. Generate the site signing key
    In GOVP → generate key. Then confirm the built-in self-test reports CONFORME — it proves your install verifies byte-for-byte like the reference implementations.
  3. Certify a post or page
    In the editor, open the GOVP panel → Certify. The declaration is fixed into a GOVP-1 record.
    # show the verifier anywhere with a shortcode [govp_verify id="GOVP-DOC-xxxxxxxxxxxx"]
  4. Route .well-known to WordPress
    The one host-dependent step: make sure requests reach PHP so the identity and records are served.
    # Nginx — inside server { }, before any static .well-known block location ^~ /.well-known/govp { try_files $uri $uri/ /index.php?$args; }
    # check it serves GOVP, not a 404 curl -s https://your-site/.well-known/govp.txt curl -s https://your-site/.well-known/govp/index.json

Production key safety. Keep the signing key out of the web root. In a production environment the plugin blocks issuing if the key sits under the web root (verification still works). Set a safe path, or sign with a KMS/HSM — see the integration guide.

Track C · CLI & self-host

Install the reference verifier

GOVP CLI 0.1.4 is the protocol's command-line verifier: it verifies local records, original files and records published at a URL; inspects deterministic inputs; derives GOVP-IDs; and returns JSON for automation. It does not yet create or sign records. Issue signed evidence today with GOVP Studio, WordPress or another conforming implementation.

  1. Install GOVP v0.1.4
    No Python or package manager is required. Review the script first if your environment requires it.
    curl -fsSL https://govp.io/install.sh | sh govp installed at /usr/local/bin/govp
  2. Or install with pip
    The release wheel is hosted by the protocol domain while the source repository completes its final private review.
    python -m pip install https://govp.io/downloads/python/v0.1.4/govp-0.1.4-py3-none-any.whl govp self-test
  3. Run the conformance self-test
    Both installation paths contain the same deterministic checks used by the public vectors.
    govp self-test GOVP self-test: PASS
  4. Verify a record and its original file
    The CLI checks format, Ed25519 signature, derived GOVP-ID and the optional artifact SHA-256 locally.
    govp verify record.govp.txt --asset original.pdf GOVP verification: VALID format pass signature pass govp-id pass asset pass
  5. Inspect or verify from a URL
    Machine-readable JSON output and deterministic signing inputs make the command usable in CI and audit scripts.
    govp verify-url https://example.org/.well-known/govp.txt govp inspect record.govp.txt govp verify record.govp.txt --json

Current boundary: verification is complete in CLI 0.1.4; key generation and signing are planned CLI commands, not released commands. Release binaries and SHA256SUMS are served by the protocol domain. Source repositories remain private during the final review and can be opened without changing the installation URL.

Next: worked examples Integration guide
← GOVP