opena2a verify

Binary integrity verification against OpenA2A trust data.

Usage

Description

Compares SHA-256 hashes of locally installed OpenA2A packages against trust data at api.oa2a.org. Checks trust profiles, oracle signatures (Ed25519), and dependency risk counts.

Options

Verifiable Packages

Without --package, the command checks these three packages, each installed with opena2a-cli. That is the list on the opena2a-cli main branch (commit 65c989fe). The newest release on npm on 2026-10-18, opena2a-cli 0.10.13, also checks a fourth name, which is not published on npm, and reports it as not installed.

hackmyagent
secretless-ai
ai-trust

Verification Checks

• SHA-256 hash comparison against registry records
• Trust profile: score (0-100), verdict (trusted / caution / untrusted)
• Oracle signature verification (Ed25519)
• Dependency risk count

Examples

Expected Output

Example output from the opena2a-cli main branch (commit 65c989fe), run on 2026-10-18 against api.oa2a.org. The note under the block lists what opena2a-cli 0.10.13, the newest release on npm on that date, prints differently. Each Version and SHA-256 value comes from the installed package; the Hash Check result and the lines after it in each block come from the registry. no data means the registry returned neither a match nor a mismatch for the hash; it is not a pass.

$ opena2a verify
Looking up installed OpenA2A package hashes in the registry


  Package          hackmyagent
  Version          0.33.2
  Hash Check       no data (SHA-256 9e5e7d723f46bd3c...)
  Trust Score      67 / 100
  Trust Verdict    passed
  Oracle Signed    warning
  Last Scanned     2026-03-02T18:20:36.807427Z
  Dependencies     0 risks

  Package          secretless-ai
  Version          0.23.0
  Hash Check       no data (SHA-256 a287f944d33f5d38...)
  Trust Score      72 / 100
  Trust Verdict    passed
  Oracle Signed    warning
  Last Scanned     2026-05-13T06:00:21.397981Z
  Dependencies     0 risks

  Package          ai-trust
  Version          0.7.6
  Hash Check       no data (SHA-256 48658b1bc87cf1d3...)
  Oracle Signed    warning

Summary: 3 no data
Registry: https://api.oa2a.org

Apart from the Version and SHA-256 values, which come from the installed packages, the output of opena2a-cli 0.10.13 differs from the block above in three places. Its first line reads Verifying binary integrity of OpenA2A packages. After the secretless-ai entry it reports a fourth name as not installed and prints an install command for it; that name is not published on npm, so the command fails. Its Summary line counts that name, as in Summary: 3 no data, 1 not installed.

How It Works

The verify command performs four checks for each installed package:

1. Hash comparison: Computes the SHA-256 hash of the locally installed package and compares it against the hash recorded at api.oa2a.org.
2. Trust profile lookup: Retrieves the trust score (0-100) and verdict (trusted, caution, or untrusted) from the registry.
3. Oracle signature: Validates the Ed25519 digital signature attached to the registry record to confirm the data has not been tampered with.
4. Dependency risk: Reports the count of known vulnerabilities in the package dependency tree.

Common Workflows

npm install hackmyagent
opena2a verify --package hackmyagent

npx opena2a-cli verify --ci --format json > verify-report.json
jq -e '.allVerified == true' verify-report.json

Error Handling

If a package hash does not match the registry record, the command reports a MISMATCH warning and exits with code 1 in CI mode. When the registry is unreachable, the command reports a connectivity error but does not fail; it notes that verification could not be completed. If a specified package is not installed locally, the command reports it as not found and skips verification for that package.

Related