Evidence packs for an auditor

An auditor asks what existed, what changed and when, and how you know the history wasn't altered afterwards. An evidence pack answers that in one file: a zip of the inventories taken over a date range, the fingerprint chain that links them, the audit log of who changed what in Collimo, and the outages and alerts of the same days, signed by a key only this Collimo holds.

Evidence packs are part of Business and MSP. Only a signed-in admin can make one, and each pack made is in the audit log.

Before you start

1. Sign-in turned on, and you signed in as an admin (see Sign-in, users and roles). A pack names who made it, so there are no packs while sign-in is off.
2. The archive kept between restarts (LEDGER_PATH, on by default). The key that signs packs is kept there.
3. Inventories taken daily (see Inventory reports), if the auditor wants to see what existed. A pack without inventories still holds the audit log and the records.
4. BACKUP_KEY set, if you copy the archive to a share or S3 (see Archive copies). The signing key goes into encrypted copies only. Without it, a rebuilt Collimo makes a new key, with a new fingerprint to give the auditor.

Give the auditor the fingerprint first

Open Settings → Evidence pack. Once the first pack is made, it shows the signing key's SHA-256 fingerprint: 64 letters and digits.

Send that fingerprint to the auditor by a different route from the packs: an email from your own address, a signed letter, or read out on a call. It is what tells them a pack came from your Collimo.

Why the fingerprint travels separately

Every pack carries its own public key, so it can be checked anywhere. But anyone can make a zip that checks against a key of their own. The fingerprint, given to the auditor some other way, is what ties the key in the pack to your Collimo. It stays the same for the life of the install.

Make a pack

1. Open Settings → Evidence pack.
2. Pick From and To. Both days are included, in the stack's time zone (TZ).
3. Click Download evidence pack. The browser saves collimo-evidence-<from>-to-<to>.zip.
4. Check it yourself before sending it (below).

The first pack also makes the signing key. Its fingerprint then shows on Settings.

A pack reaches back as far as Collimo keeps things: the audit log and records for LEDGER_RETENTION, and inventories for INVENTORY_KEEP. Settings → Evidence pack shows both. For seven years of evidence, set both to seven years (LEDGER_RETENTION=61368h, INVENTORY_KEEP=2557).

What is in a pack

File	What it is
README.txt	What each file is, and how to check the pack
manifest.json	The range, who made it and when, and each other file's size and SHA-256
manifest.sig	The Ed25519 signature over manifest.json
public-key.pem	The public key that checks the signature
SHA256SUMS	The same hashes, for sha256sum -c
inventory/	The inventories taken in the range, as stored; chain.jsonl, every inventory's fingerprint and the one before it; check.json, Collimo's own check of the whole history when the pack was made
audit.jsonl	The audit log in the range: sign-ins, changes to users, settings and thresholds, tool runs, packs made
records.jsonl	The archive's records in the range: outages, alerts, reboots, firmware changes, link speed changes

Never in a pack: the private key, passwords, tokens, license keys, sign-in sessions, or anything from the settings store.

Check a pack

With the Collimo image, from the folder the pack is in:

docker run --rm -v "$PWD:/pack:ro" ${COLLIMO_IMAGE}:${COLLIMO_VERSION} -verify-pack /pack/collimo-evidence-2026-01-01-to-2026-03-31.zip

It ends with PASS or FAIL, and prints the key's fingerprint. A PASS says:

• the signature over the manifest is good;
• every file is the size and SHA-256 the manifest says;
• every inventory in the range is there, matches its own fingerprint, and follows the one before it in the chain.

A FAIL lists each problem and names the file: audit.jsonl was changed: its SHA-256 does not match the manifest. Then check the fingerprint it prints against the one you were given.

Checking with OpenSSL alone

An auditor without Collimo can unzip the pack and run, with OpenSSL 3:

openssl pkey -pubin -in public-key.pem -outform DER | openssl dgst -sha256
openssl pkeyutl -verify -pubin -inkey public-key.pem -rawin -in manifest.json -sigfile manifest.sig
sha256sum -c SHA256SUMS
sha256sum SHA256SUMS

The first prints the fingerprint; the second, Signature Verified Successfully; the third, OK for every file. The last hash must be the one listed for SHA256SUMS in manifest.json. This proves the files are as Collimo made them; that the inventory chain inside is unbroken is what -verify-pack adds.

When something is wrong

• The pack fails because of Collimo's own history check. The inventories on the volume were changed or removed outside Collimo. The same problem shows as Inventory history in Needs attention. The pack still says exactly what was found, which is itself evidence.
• Settings says the key is damaged. evidence-key.json on the archive volume can't be read. Restore it from an encrypted archive copy. If that isn't possible, move the file aside: the next pack makes a new key, and the auditor needs its new fingerprint.
• The button is grayed out. The license doesn't cover packs, or LEDGER_PATH is empty. Settings says which.