Produce an evidence bundle

This guide: export an evidence bundle for a backup artifact and verify it offline with the matching public key. The bundle is what a compliance reviewer uses to confirm a backup exists, is signed, and has an intact audit chain — without trusting the dashboard.

Prerequisites

• A protected database with at least one completed backup.
• Node 20+ on the machine where you will verify the bundle.

Step 1: Export the bundle

1. In the dashboard, open the database detail page.
2. In Backup history, find the backup artifact you want evidence for.
3. Click Download evidence bundle. You get a .tgz containing the signed manifest and every audit event for that artifact.

Step 2: Verify it offline with the matching public key

The verifier runs without contacting walwarden once you have the bundle and its matching public key. Confirm the current key-readiness status, download the public Ed25519 verification key, then run the verifier:

# Walwarden's published public key
curl -O https://walwarden.com/.well-known/walwarden-pubkey.pem

# Verify the bundle you exported
npx --yes @walwarden/verifier \
  --bundle evidence-bundle.tgz \
  --pubkey walwarden-pubkey.pem

A successful run prints, for example:

OK: 1 manifests verified, 6 audit events chain-intact  (exit 0)

Verify it worked

The verifier exits 0 and reports the manifest signature valid and the audit event sequence contiguous. A successful verifier run with the matching public key is the acceptance signal; key publication alone does not prove a customer bundle. An auditor can re-run the same command on an air-gapped machine given only the bundle and key.

For what the audit chain records and how verification works in detail, see The audit chain.