# Verifying the valve.xmr archive

1. Fetch the whole tree from IPFS (any gateway or your own node):

       ipfs get <CID> -o valve-mirror && cd valve-mirror

2. Check every file against the manifest:

       sha256sum -c SHA256SUMS

3. Check the signature of the manifest (Ed25519, OpenSSL >= 1.1.1):

       openssl pkeyutl -verify -pubin -inkey pubkey.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
       openssl pkeyutl -verify -pubin -inkey pubkey.pem -rawin -in manifest.json -sigfile manifest.json.sig

   Public key fingerprint (SHA-256 of the DER-encoded key):

       be7dc02ea086de41d868e18df3a44f8ec101076cb9f6d2b4e7f86aa2da7b7474

   Confirm this fingerprint through an independent channel before trusting it:
   phishdestroy.io, the PhishDestroy Telegram channel, or an ENS text record on steamdestroy.eth.

4. The `raw/` directory holds the unmodified sources (site HTML, Medium payloads, Telegram export).
   Each rendered dossier states the SHA-256 of the source it was rendered from.

Built 2026-09-11T07:35:11+00:00. License: MIT + public-domain waiver.