Your browser fetched the live BluBox files straight from this site —
the same files the app runs on.
2Fingerprinted
It computed each file’s unique fingerprint, right on your device.
3Compared
It compared every fingerprint with the list we publish at
release.json.
The math runs on your device. Nothing is uploaded, and no result is
reported to anyone but you.
File by File
What This Proves, and What It Does Not
It proves the files this site is serving right now hash to exactly the values in
the published manifest — so the running code is the released code, byte for byte.
The honest limit: the same server serves the app, the manifest, and this page.
A server that swapped all three together would still show a match. That is why the next rung
publishes the fingerprint on PulseChain — a referee nobody can edit — and why the
rung after it puts every release on IPFS, where the address is the hash.
Check it yourself, independently: download a file and hash it with your own tools —
on a Mac or Linux box, shasum -a 256 <file> — then compare that
against release.json by eye. That path trusts nothing on this page.