How to "verify" that an author created a specific post

[julien51]

I'm building an application which will verify that a specific author actually published a post.

To achieve this, given a post, I want to check that the author's public key was indeed used to publish.

My understanding is that this requires a few things:

• Get the public key from the DID
• Get the relevant commit(s?) in a user's repo for a specific message.
• Compare the commit signature and the author's public key

Is this the correct approach? Would anyone be able to provide a bit more details for each of these steps?

Thanks for your precious help!

[DavidBuchanan314]

pdsls is an example of an app that implements this (via the https://github.com/goeo-/public-transport library)

[yamarten]

In general, since the signature is attached to the root of the hash tree, it is necessary not only to verify the signature but also to ensure that it is linked to the desired record. You can use com.atproto.sync.getRecord to get the path from the record to the root.

That's what public-transport does. In addition, Bluesky's verifyProofs is also helpful.

[julien51]

Ok Thx! that's helpful!
So first, I will check that the post's CID is the MST (using a Merkel proof ?) and then check that the signature matches the root.

[julien51]

I think I was able to build what I was looking for! Thanks @yamarten !