WACZ integrity in UI (Archive Receipt UI)

[benhylau]

WACZ files are authenticated archives with authsign signatures. I'd like the player on replayweb.page and any embedded versions to have:

1. An icon to indicate that a cryptographic signature exists in the WACZ
2. Indication that the content rendered in the player is consistent with the signature in the WACZ
3. The signing domain of the WACZ

This can be a lock icon, for example, that shows up green when signature verifies and turns into a red warning sign when the content has been tampered with. When clicked on, more info such as the datetime of the signature and the signing domain should be displayed.

[ikreymer]

Still working on the exact interface with @Shrinks99, but here's a very first pass:

There's probably three different stages of verification we should include, in order of strength:

1. no signature data in WACZ / not WACZ
2. signature data, but signed anonymously via ArchiveWeb.page
3. signature data, but signed via trusted observer, via Browsertrix Cloud/authsign

And:

1. All hashes loaded validate
2. All hashes loaded do not validate. Possible to also include how many hashes have been validated (which will increase as more URLs are loaded).

[Shrinks99]

Haven't kept up with this issue 😅

Just for tracking, here's a pic of the current mockup for the Archive Receipt UI that will appear above embedded tweets and things.

When hashes don't check out the bar looks like this:

For the AP article implementation (where the witness cert may be either self signed or signed from a domain) we aren't including a mid-level state of authenticity feedback. This may change at some point in the future.

[ikreymer]

Released in 1.7.0!