GovernanceOS
Open-source tools from GovernanceOS, under the Apache License 2.0. They run on your own machine with Python 3 and nothing else installed, and they make no network calls.
pip install governanceos
gos-verify: verify an evidence pack offline
An institution that keeps its AI governance records in GovernanceOS can share an evidence pack with an examiner. gos-verify checks that pack on the examiner's own machine:
- It recomputes the SHA-256 hash of every record, checks that each links to the one before it, and checks that the positions run without a gap.
- It checks the Ed25519 signature over the whole pack: the header, every record and the summaries.
- It prints the signing key's hash and compares it with the one the institution sent you by another route (
--key), and compares the head with a head it sent you (--expect). - It says plainly that the public anchor was not checked, because that needs a network.
gos-verify PACK.json --key KEYHASH [--expect HEAD]
| Exit | Meaning |
|---|---|
| 0 | Verified: intact, and signed by the key you pinned |
| 1 | Intact, but the signer is not pinned |
| 2 | Chain broken |
| 3 | Signature invalid |
| 4 | Head differs from --expect |
| 5 | The pack cannot be read |
| 6 | The key differs from --key |
What it proves: the pack was not changed after the key you pinned signed it. What it does not prove: that the records were true when they were written. That is for the examination.
The same verifier is the single-file download at governanceos.si/verify. The two are byte-identical.
Try it
tests/data holds a sample pack from a fictional institution and a tampered copy of it:
python -m unittest discover -s tests -v
License
Apache License 2.0; see LICENSE and NOTICE. The license grants no rights to the GovernanceOS name or marks (section 6).
1 maintainer
Metadata
1 maintainer
Release files for governanceos 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| governanceos-0.1.0.tar.gz | 12.1 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| governanceos-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 24.4 kB
Release files / governanceos-0.1.0.tar.gz
| Download URL | governanceos-0.1.0.tar.gz |
|---|---|
| Size | 12.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
c455e1c6d27b766c106e62cbe71b3e60276692cdc6a60fa5145eefb44a70baa9
|
|
BLAKE2b-256 checksum How to use checksums |
58c288279a2324f946315c5259f86357c2898c9da7a0576c9acb8282b9f034e4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.
Transparency logRelease files / governanceos-0.1.0-py3-none-any.whl
| Download URL | governanceos-0.1.0-py3-none-any.whl |
|---|---|
| Size | 12.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
36ae40b1235a07c9837cee8d88e4015494ea8a61f3c0341d607be17603d1595b
|
|
BLAKE2b-256 checksum How to use checksums |
d1ebcfe789ca5278d0c73b2268775cfffdba5414453e98c2665978d0d3410938
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.
Transparency logSecurity for governanceos 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for governanceos-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
