Zain Dana HarperEMET · byte checks

Check that a file is still the file you saved.

EMET checks whether the bytes that reach a model, reviewer or pipeline still match their source. It anchors content, compares it later, neutralizes instructions embedded in it, and writes a verdict file that its Python, Rust, Node and Go implementations all read the same way.

See it work, step by step: an animated walkthrough with the real commands and output from the repository.

emet · 1.3.0 on PyPI · Python, Rust, Node and Go
Plate 01 A structure dissolving into sorted runs of pixels.

Try it

$ python -m pip install emet==1.3.0
$ emet selftest

EMET saves a SHA-256 fingerprint of a file, a prompt or a view, then later reads the bytes again and compares. Use it before a model, a reviewer or a pipeline reads content that should not have changed.

Three answers

MATCH the bytes still match the saved fingerprint
DRIFT the bytes, or the view shown to you, no longer match
UNVERIFIABLE the file could not be read or there was no saved fingerprint, with the reason

Change one byte and the answer changes

Live one appended byte
$ python membrane.py verify demo_sample.txt
MATCH  demo_sample.txt   want=d02206abca2a…  got=d02206abca2a…   (exit 0)

# append one byte to the file, ask the same question
$ python membrane.py verify demo_sample.txt
DRIFT  demo_sample.txt   want=d02206abca2a…  got=b072d611645e…   (exit 1)

# one spec, four language implementations, CI on every push
membrane.py        →  CONFORMANCE 48/48 vectors pass
impl/rust/emet     →  CONFORMANCE 40/40 supported vectors pass
impl/js/emet.js    →  CONFORMANCE 40/40 supported vectors pass
impl/go/emet       →  CONFORMANCE 35/35 core vectors pass

The shared suite has 48 vectors: 35 core, 5 receipt, 4 rebind and 4 evaluation-receipt cases. Python runs all 48, Rust and Node run 40, and Go runs the 35 core vectors. See a sample report →

EMET v1.3.0 release

v1.3.0 on GitHub and emet 1.3.0 on PyPI. PyPI serves the wheel and source archive.

Releasetag v1.3.0, source commit b37da003951866ece403fb08fe3d028d00c39f4f
PyPIwheel SHA-256 1a2bea4f9a7cdab07bc6b883f8487673bf985f793d125ce18a4cf86d66044a09; source archive SHA-256 b28d6763db1d8db0f376cb6f33dffa3e6e649c65d9843483dd395f71e3f36d02
ProtocolFlywheel review protocol, run from source checkouts

Machine-readable status: security-tools.json.

PyPI: emet  ·  Email: zaindharper@gmail.com  ·  License: MPL-2.0  ·  ← the map  ·  the index