Consortium root fingerprint

If you have CELLO installed

Run cello status and compare consortium_root_fingerprint with the value above. They must match exactly. Beside it, consortium_root_fingerprint_state says where that key set came from: bundled is the one compiled into the client, overridden means an environment variable has pointed the daemon at a different consortium, and not_anchored means it is verifying no manifest at all. The client reports what is in force rather than what it shipped with.

What this cannot tell you, said plainly: the comparison runs inside the client you are already running. It catches a fork that reuses our client, which is the common case. It cannot vouch for a client you obtained from somewhere other than the published packages — which is the reason to install from them.

If you have not installed anything

You should not have to install software in order to decide whether to trust it. The same fingerprint is published as a file in the open-source client repository, and it is recomputable from the root key with sha256 and nothing else:

curl -fsSL https://raw.githubusercontent.com/Mygentic-AI/cello-client/main/consortium-fingerprint.json

printf 'cello-consortium-root-v1\ne8300a2b9de7be6f6d629f778dc319715ad0010c0639f3a1564181d56d3eb104\n1\n' | shasum -a 256
# → 60e4147d93559b1cdb0b362ae36eedd6e82ea825a4e68d02bf9c1f9618683dbf

Two independent places to read the published value, and the arithmetic in between, so a fork would have to compromise both for its own number to be believed here.

What the fingerprint covers

It is the SHA-256 digest of the consortium officer root public key set and the number of signatures required from it — 1 of 1 today. Those are the exact values the client verifies every consortium manifest against, so the fingerprint changes if, and only if, what the client will accept changes.