Whisper edge reputation feed
============================

Free, keyless, no account. Blocks IPv4 and IPv6 prefixes with a citable listing
behind them, and refuses to block anything it cannot cite.

  /edge/snapshot.bin              551416 bytes  the binary snapshot, for the nginx/Apache/LiteSpeed modules
  /edge/snapshot.json               1042 bytes  what the snapshot contains, including the guard refusal counts
  /edge/snapshot.bin.sha256           79 bytes  sha256sum of snapshot.bin, so a fetcher can verify it without parsing anything
  /edge/snapshot.ledger.json         300 bytes  the transparency-ledger EntryID for this snapshot, so you can ask for an inclusion proof
  /edge/rpz.zone                  138640 bytes  the same policy as a Response Policy Zone, for a resolver rather than a web server
  /edge/snapshot.bin.sig              64 bytes  a detached Ed25519 signature over snapshot.bin, checkable wherever the file ends up
  /edge/edge-signing-key.pub         113 bytes  the public key that verifies snapshot.bin.sig
  /edge/edge-signing-key.pub.asc       228 bytes  an OpenPGP signature over edge-signing-key.pub, made with our release key

  snapshot.bin is also served pre-compressed: send Accept-Encoding: gzip (curl
  --compressed) and you fetch 13868 bytes instead of 551416, about 39x smaller.
  Conditional requests work, so an hourly poller that sends If-None-Match
  normally gets a 304 with no body at all.

  snapshot.bin is SIGNED. The signature is detached, so it travels with the
  file: check it wherever the file ends up, with no connection to us.

    curl -fsS https://whisper.online/edge/edge-signing-key.pub -o edge.pub
    curl -fsS https://whisper.online/edge/snapshot.bin.sig -o snapshot.bin.sig
    openssl pkeyutl -verify -pubin -inkey edge.pub \
        -rawin -in snapshot.bin -sigfile snapshot.bin.sig

  Fetch the key ONCE and keep it; fetching it every time only proves that
  whoever served you the snapshot also served you the key.

  And the key itself is signed with our RELEASE key, the one install.sh
  verifies every CLI download against - so you can check it on the FIRST
  fetch rather than trusting whoever handed it to you:

    curl -fsS https://as219419.net/whisper-release.asc | gpg --import
    curl -fsS https://whisper.online/edge/edge-signing-key.pub.asc -o edge.pub.asc
    gpg --verify edge.pub.asc edge.pub

The signed plane manifest, generation 1792382402:
  /edge/manifest.json   and its signature at /edge/manifests/<sha256 of those bytes>.sig
  reputation         /edge/planes/7497cf3500ccacd8e4e859748026a0c9ed093c3ed29fa838e8776e0a0a2c1740.bin, valid until 2026-10-20T04:00:00Z
  routing            built and WITHHELD: BGP_CLOCK_UNKNOWN, UNPINNED, VRP_SPLIT_DATASET, VRP_CAP_UNSET, BGP_PUBLISH_OFF
  rpki-unreachable   built and WITHHELD: BGP_CLOCK_UNKNOWN, UNPINNED, VRP_SPLIT_DATASET, VRP_CAP_UNSET, BGP_PUBLISH_OFF
  tor                built and WITHHELD: LOW_RECALL, IPV6_NOT_STATED

The same policy is also served as a DNS zone, rpz.whisper.online,
which you can look at (dig SOA) but cannot yet transfer: a transfer needs a TSIG
key, and while the per-zone scoping a key like that needs is built, there is no way
to request one yet.
Fetch /edge/rpz.zone instead; it is the same policy.

That zone carries nameserver triggers (rpz-nsip) for Spamhaus DROP space that the
snapshot has no way to express, so the two artifacts are the same policy over
addresses and the zone is a strict superset over delegations.