Verify an orz document
Checks files of orz-mdhtml 1.2 (and 1.0), orz-slides 1.2 (and 1.0) and orz-paged 1.2 (and 1.0) (text format 1), and of their 0.x releases
Check whether a .md.html / .slides.html / .paged.html file
carries the genuine, unmodified orz framework, and scans its content for embedded code.
Everything runs in your browser; the file is parsed inertly and never executed.
Note: authenticity checks compare the file against the matching
published browser package: orz-mdhtml-browser, orz-slides-browser, or
orz-paged-browser. A 1.0 file (text format 1) is re-assembled from the text it carries by the
published package of its own version and must come out byte for byte the same.
What this can and can't tell you
Strong: for a 1.0 file (orz-mdhtml, orz-slides or orz-paged 1.0 and later; text format 1) it
downloads the engine of the file's own version from jsDelivr, checks it against the SHA-384 in that release's
release.json, compares the file's engine (inline) or engine URL (--cdn) with it, and
then lets that published engine — in a sandboxed frame that cannot reach this page — assemble the text the file
carries. A genuine file comes out byte for byte the same, so anything added to or changed in the
shell is caught. For an older (0.x) file it hashes the embedded engine bundle and editor and compares them
byte-for-byte to the canonical packages.
Heuristic: it lists every inline script and flags raw <script> /
on…= handlers and off-CDN loads in the content (the html:true vector). It can surface
red flags but cannot prove arbitrary content is benign.
Limits: the framework check needs the package version to be published (else it reports
“couldn’t fetch canonical”). And this page is only as trustworthy as the site serving it — you’re trusting
markdown.orz.how. A file always remains code; treat unknown ones like programs.