How does the "cryptographically verifyable" part of crev work?

[arnohaase]

I just came across crev, love the concepts, this looks great - thanks for the effort first of all!
I looked through the book but did not find anything about how cryptographic verification is done - the registry files referenced from registry.toml have neither signatures nor digests for the audited libraries.
Any pointer would be greatly appreciated.

[dpc]

If you mean the integrity of the package, then a deterministic checksum of package content is calculated and signed over in every review, so anyone can compare if the content of the package is the same as was reviewers reviewed. Example.

The checksum code is here: https://github.com/crev-dev/recursive-digest

[arnohaase]

excellent, I had missed that. Thanks!