VQX

Verify before use

Trust & provenance

A hash proves bytes match an expected digest. It does not prove who published them when the hash comes from the same server.

VQX 0.3 verification chain

  1. Fetch codecs and hashed zips from https://vqx.zlapp.app (not GitHub tools/vqx unless that path 200s on the default branch).
  2. Run the Python/JavaScript conformance and malformed-input tests against those bytes.
  3. Compare SHA-256 to SHA256SUMS.txt.
  4. Do not expect publisher attestations; none are published.

Machine-readable trust metadata: /machine/trust.json.

License note: VQX artifacts are Apache License 2.0. /LICENSE is byte-identical to the LICENSE file inside the 0.3 zips. This does not relicense the rest of zlapp-app.