The verifier
The verifier checks a Hangar job certificate on your own machine, so you do not have to trust Hangar's word. Anyone can use it with no account, and it costs no credit.
Run the verifier with hangar verify <certificate>. It works offline. You can also run it in a browser.
This page covers:
hangar verify <certificate>, which runs offline;- the browser verifier, which is the same code compiled to WebAssembly, so you can save it and run it with no network;
- the published keys and tree heads, and how the verifier checks the signatures, the inclusion proof and the hash of the certificate;
- how to report a discrepancy.
The facts check also checks where the data of the job was. A certificate from Hangar 4.17.0 lists each place where the data was stored, processed or staged, and the Region policy that the job ran under. The verifier confirms that each place is in a Region that the policy allows. The verifier confirms that the job ran in the Region of the cell that the certificate names as its signer, and that an "only" setting names its own Region for that cell and for the home cell. The verifier confirms that a job outside its preferred Region states why. The verifier builds the statement of where the data was from the places and the policy, and compares it with the statement on the certificate. The format is in certificate_format.md, Section 9.6.