Before publication
Public-inspection PDF
206,676 bytes · 2 pages
Read the inspection copy ↗Waymark / Source identity desk
Follow the record.
Check the copy.
Inspect the original notice, read the pinned code, and check who published an address. Then compare your own file.
05 October 2026 Five records Public sources
01 Publisher02 Record03 Version04 Exact bytes
Identity is one part
of an assessment.
The date beside a document matters.
State Department notice 2025-02873 designates eight organizations. Its signed date, filing date and publication date describe different events. The text makes the designations effective upon publication.
- Signed
- 06 Feb 2025
- Filed
- 19 Feb 2025
- Published
- 20 Feb 2025
The public-inspection copy announces a scheduled publication. The final Federal Register pages carry the published notice; GovInfo’s XML identifies the same document as 90 FR 10030–10031. The PDFs have different layouts and different hashes.
Published record
Federal Register PDF
178,279 bytes · 2 pages
Read the published notice ↗Checked both PDFs and GovInfo MODS metadata. The final PDF includes adjacent notices: use Public Notice 12672 and FR Doc. 2025-02873 to locate this one. This is a historical publication check.
Pin the code you actually read.
The urllib3 streaming study compares response.py in two releases. I resolved each annotated tag through GitHub’s API, fetched the file at its commit, and calculated its SHA-256.
urllib3 2.7.0
Line read without a length argument
Lines 1338–1354 · 53,219 bytes
9a950b92d999f906b6020bb2d1076ee56cddd5d2urllib3 2.8.0
Line length checked before conversion
Lines 1362–1383 · 54,628 bytes
b1d30ab61fe0db8f11092805e8c5ac43e091064aGitHub reported both tag signatures valid; they were not independently verified locally. These entries record source identity. The linked parser study reports its separate controlled regression. How commit permalinks work ↗
03 / Publisher identity
An address needs
an attribution.
Who published the onion address?
These addresses came from the publishers’ own HTTPS pages. I checked each address’s version and checksum locally. That checks its encoding; the publisher’s page supplies the attribution. Neither establishes whether the service is reachable today.
Tor Project
Registry checkedOfficial onion registry ↗ · entry for www.torproject.org
2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onionVersion 3 / checksum matches / service connection not tested.
Central Intelligence Agency
Historical announcementPublisher announcement, 7 May 2019 ↗
ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onionAnnouncement still available on the review date. Version 3 / checksum matches / service connection not tested.
The desk makes no onion connections. Tor’s address specification defines the checksum; Onion-Location describes publisher discovery through HTTP headers or page metadata.
04 / Your copy
Compare exact bytes.
Keep the file local.
The file check.
Choose a file already on your device and paste an expected SHA-256. Leave the digest blank to calculate one. This tool reads the file in your browser; it does not upload it.
Local Web Crypto SHA-256. Saving through an editor can change line endings or encoding and produce a different digest. The stored hashes describe the bytes retrieved on 5 October 2026.
Open the trail
Keep the evidence with the claim.
The JSON includes source URLs, file lengths, hashes, revision IDs, dates, checks performed and their limits.