Finding 2026.1Conventions for signed findings in this library

§2026.1(i) Purpose

This finding fixes the conventions under which every later finding in the library is released. It exists so that the conventions are themselves citable, versioned, and subject to the same digest and errata discipline they describe. A reader who wants to check any finding needs only this note, a copy of the finding's source, and a SHA-256 implementation.

§2026.1(ii) Numbering and versioning

Findings are numbered by year of release and by order within the year: 2026.1 is the first finding released in 2026, 2026.2 the second. Numbers are assigned once and never reused. Sections within a finding are lettered in lower-case roman numerals, so that this section is §2026.1(ii); equations and figures are numbered 2026.1.1, 2026.1.2, and so on through the finding.

Each finding carries a version, beginning at 1.0. A change that corrects an error increments the minor version and is recorded in the Errata with its date; a change that alters a result or a conclusion increments the major version and is announced as such. The rendered page shows the release date, the date of the latest version, and the version number. A citation should give the version.

§2026.1(iii) Source digest

The source of each finding is a Markdown file. It is published unchanged beside the rendered page, at the address of the finding with the extension .md, and the digest printed on the page is

where $H$ is SHA-256 [RFC6234] computed over the exact bytes of the file as served, including its front matter. The rendered page is derived from the source by the site's generator and carries no digest of its own; the source is the object of record.

§2026.1(iv) Signature

Where a finding is signed, the signature is

an Ed25519 signature [RFC8032] over the 64-character lower-case hexadecimal encoding of the digest, treated as ASCII bytes without a trailing newline. Because the digest covers the whole source file, the signature cannot live inside it; it is kept in a detached file with the extension .sig, published beside the source, and printed on the page in hexadecimal beneath the digest. The public key under which signatures are to be verified is published under Citing; when no key is published there, no finding is signed, and the digest alone is the object of verification.

§2026.1(v) Corrections

A released finding is never edited in place without record. A correction is applied to the source, the version is incremented, the digest changes, and the Errata gain an entry naming the finding, the date, and the nature of the correction. The previous source remains available in the site's version history. A reader holding a copy whose digest does not match the published digest should consult the Errata before concluding that either copy has been tampered with; the more likely explanation is a recorded correction.

§2026.1(vi) Verification

To verify the finding numbered YYYY.n:

curl -sS https://ryanjamesyork.com/findings/YYYY/n.md | sha256sum

The result must equal the digest printed on the finding's page and, for a cited version, the digest recorded in the citation. To verify a signature, obtain the public key from the Citing page and check the signature over the ASCII hexadecimal digest with any Ed25519 implementation; with openssl (3.0 or later) and the key in PEM form:

printf '%s' "$DIGEST" > digest.txt
curl -sS https://ryanjamesyork.com/findings/YYYY/n.sig \
  | python3 -c 'import sys,binascii; sys.stdout.buffer.write(binascii.unhexlify(sys.stdin.read().strip()))' > sig.bin
openssl pkeyutl -verify -pubin -inkey key.pem -rawin -in digest.txt -sigfile sig.bin

where sig.bin is the binary form of the printed signature. Verification that succeeds establishes that the source is the one the key holder released; it does not establish that the contents are correct, which is the business of the Errata and of later findings.