Receipts

Walrus records that a blob is held. A receipt on Sui records what it was, as the deployment saw it witnessed:

• A content fingerprint, and which kind it is. Hash your copy and compare. The receipt says what to compute, so a third party never has to ask the deployment.
• Version history. When you overwrite a key, the new version’s receipt points to the one it replaced. Large files uploaded in parts work the same way. A new key starts a new history.
• Whether it was stored encrypted, and where to find it.

Once written, a receipt can’t be changed by anyone, the deployment included verifiable. It can’t be transferred or traded, and your users aren’t named on a public chain.

A receipt is public. Anyone holding its id sees when the file was written, how large it is, how many parts it has and the storage ids that hold them; never your file names, buckets or account verifiable.

Check it without us

• Ask the deployment, with no credential: does it hold provenance for this hash? That answer is the deployment’s own witnessed; the rest need nothing from us.
• Open it on any Sui explorer or node. No account or wallet. verifiable
• It outlives the storage. A receipt resolves after the span ends, and if you never talk to us again.
• Warranties bind their claims to these files.

Verify against the receipt, retrieve against the span.

Salted fingerprints

A plain fingerprint of a small or predictable file can confirm a guess. A salted fingerprint can be checked only by someone holding the salt: anyone you give the file and the salt, still without us. verifiable

Choose per object with x-amz-meta-permafrost-fingerprint-kind (S3 compatibility):

Kind	Fingerprint of
plaintext	your file; anyone with the file can check it
salted	your file, salted; only a salt holder can check it
stored	the bytes as stored

• Defaults: salted whenever the stored copy is encrypted: under deployment keys, the default, and under your own key service. plaintext with x-amz-meta-permafrost-encrypt: none and no key service, where anyone who finds the stored copy can read it anyway.
• Check with pf-verify, the file and the salt (Verify a file).
• Salt hides content only if the stored copy is encrypted. With x-amz-meta-permafrost-encrypt: none, anyone who finds the copy on Walrus can read it.

An integrity check on upload

Send the file’s sha256 in x-amz-meta-permafrost-sha256 on PutObject or each UploadPart. A mismatch is refused with 400 BadDigest before anything is stored. Under your own key service this is the transit check to use, because the ETag describes the encrypted bytes.

Encrypted before upload? Hash your encrypted copy; that’s what the receipt covers.

→ Verify a file