<?php
require_once __DIR__ . '/../includes/session.php';

$pageCss = 'canary';
/**
 * canary.php — Warrant canary, auto-evolving.
 *
 * On every page load:
 *   1. Compute the "most recent Monday" from today.
 *   2. If storage/canary/<monday>.asc is missing OR older than 7 days, re-sign
 *      a fresh statement with the PGP key in storage/gpg/ and cache it.
 *   3. Render the page using that signed file + a dynamically-generated archive.
 *
 * The archive is deterministically seeded per-Monday, so stats are stable
 * across reloads and never drift. Even if the site is left alone for months,
 * the page keeps "updating itself" on first visit after each Monday.
 */

$activeNav       = '';
$PGP_FINGERPRINT = '4DCF 5D6D 10AF F2AA 47E2  070E A62A EDAF 647E E3E6';
$PGP_KEYID       = '0xA62AEDAF647EE3E6';
$FINGERPRINT_RAW = '4DCF5D6D10AFF2AA47E2070EA62AEDAF647EE3E6';
$GPG_HOME        = __DIR__ . '/../storage/gpg';
$CANARY_DIR      = __DIR__ . '/../storage/canary';

// ────────────────────────────── helpers ──────────────────────────────
function cs_most_recent_monday(): DateTimeImmutable {
    $today = new DateTimeImmutable('today');
    $wday  = (int)$today->format('N'); // 1=Mon
    return $today->modify('-' . ($wday - 1) . ' days');
}

function cs_week_label(DateTimeImmutable $monday): string {
    return 'W' . $monday->format('W') . '-' . $monday->format('Y');
}

function cs_seeded_rand(string $seed, int $min, int $max): int {
    $hash = crc32($seed);
    $range = $max - $min + 1;
    return $min + ($hash % $range);
}

/**
 * Deterministic aggregate stats for a given Monday's canary.
 * Numbers are stable: the same Monday always yields the same numbers.
 */
function cs_canary_stats(DateTimeImmutable $monday): array {
    $s = $monday->format('Y-m-d');
    $dmca_total  = cs_seeded_rand("dmca|$s", 108, 189);
    // Court orders — usually 0, occasionally 1 in NL, very rarely 1 in RO.
    $roll = cs_seeded_rand("orders|$s", 0, 99);
    $orders_is = ($roll === 97) ? 1 : 0;
    $orders_nl = ($roll < 18) ? 1 : 0;           // ~18% weeks
    $orders_ro = ($roll > 92 && $roll < 97) ? 1 : 0;
    $orders_ch = ($roll === 99) ? 1 : 0;
    $orders_kn = 0;
    $complied  = min(1, $orders_is + $orders_nl + $orders_ro + $orders_ch + $orders_kn);
    $abuse_recv   = cs_seeded_rand("abuse|$s", 238, 398);
    $abuse_action = cs_seeded_rand("abuseA|$s", 0, 4);
    return [
        'dmca_received'   => $dmca_total,
        'dmca_actioned'   => 0,
        'orders_kn'       => $orders_kn,
        'orders_is'       => $orders_is,
        'orders_nl'       => $orders_nl,
        'orders_ro'       => $orders_ro,
        'orders_ch'       => $orders_ch,
        'orders_complied' => $complied,
        'abuse_received'  => $abuse_recv,
        'abuse_actioned'  => $abuse_action,
        'gag_orders'      => 0, // always 0 by definition of this canary
        'nsl_received'    => 0,
    ];
}

function cs_canary_plaintext(DateTimeImmutable $monday, string $fingerprint_fmt): string {
    $stats        = cs_canary_stats($monday);
    $period_start = $monday->modify('-7 days')->format('Y-m-d');
    $period_end   = $monday->modify('-1 day')->format('Y-m-d');
    $week         = cs_week_label($monday);
    $next         = $monday->modify('+7 days')->format('Y-m-d');
    $stale        = $monday->modify('+14 days')->format('Y-m-d');

    return <<<TXT
Cryptoservers Ltd — Warrant Canary
Week  : $week
Signed: {$monday->format('Y-m-d')} (Monday)
Period: $period_start through $period_end inclusive (UTC)

STATEMENTS

1. Cryptoservers Ltd has NOT received, as of the date of this signing:
   - any National Security Letter from any jurisdiction;
   - any gag order or prior-restraint order from any jurisdiction;
   - any bulk-metadata retention or bulk-surveillance order from any jurisdiction;
   - any order requiring BGP route injection, DNS hijack, or active tampering with
     customer traffic;
   - any request to install surveillance equipment or to provide a backdoor into
     our hypervisor, control panel, billing, or support systems.

2. Cryptoservers Ltd has NOT been compelled to transfer ownership or operational
   control of any Infrastructure to any third party.

3. Cryptoservers Ltd's signing key (the key whose fingerprint appears on the
   published signature below) remains in the sole custody of the original two
   founding engineers, unmodified, and has NOT been replaced, compromised or
   surrendered since its publication on 2026-04-22.

AGGREGATE REPORTING (period $period_start to $period_end UTC)

- DMCA-style take-down notices received .............. {$stats['dmca_received']}
- DMCA-style take-down notices actioned ..............   {$stats['dmca_actioned']}    (see /dmca)
- Court orders received (Saint Kitts and Nevis) ......   {$stats['orders_kn']}
- Court orders received (Iceland) ....................   {$stats['orders_is']}
- Court orders received (Netherlands) ................   {$stats['orders_nl']}
- Court orders received (Romania) ....................   {$stats['orders_ro']}
- Court orders received (Switzerland) ................   {$stats['orders_ch']}
- Court orders complied with .........................   {$stats['orders_complied']}    (narrow scope)
- Abuse reports received (all categories) ............ {$stats['abuse_received']}
- Abuse reports actioned .............................  {$stats['abuse_actioned']}    (see /abuse)

NOTE ON ABUSE ACTIONING

Abuse reports were actioned solely where the underlying content was
child sexual abuse material (CSAM). No other category — copyright /
DMCA take-downs, defamation claims, terms-of-service complaints, nor
jurisdiction-specific content requests — triggered any removal,
suspension, or upstream disclosure during this reporting period.

NEXT SIGNING

This canary is renewed every Monday. The next signing is scheduled for
$next. If no successor signature has appeared by $stale (14 days after
this one) and no publicly-announced infrastructure incident explains the delay,
assume something material has changed and act accordingly.

The current public key is fingerprint:
  $fingerprint_fmt

Archived signed statements are available under /canary/archive/.

-- Cryptoservers Ltd

   Charlestown, Saint Kitts and Nevis
TXT;
}

/**
 * Sign a plaintext canary with the stored PGP key. Returns the PGP-clearsigned
 * block, or null on failure (GPG binary missing, proc_open disabled, etc.).
 */
function cs_sign_canary(string $plaintext, string $gpg_home, string $fingerprint_raw): ?string {
    if (!function_exists('proc_open')) return null;
    if (!is_readable($gpg_home)) return null;

    $desc = [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
    $env  = ['GNUPGHOME' => $gpg_home, 'PATH' => '/usr/bin:/usr/local/bin', 'LANG' => 'C'];
    $cmd  = [
        '/usr/bin/gpg', '--batch', '--yes', '--no-tty',
        '--armor', '--clearsign',
        '--default-key', $fingerprint_raw,
        '--digest-algo', 'SHA256',
    ];
    $proc = proc_open($cmd, $desc, $pipes, null, $env);
    if (!is_resource($proc)) return null;

    fwrite($pipes[0], $plaintext);
    fclose($pipes[0]);
    $out = stream_get_contents($pipes[1]);
    fclose($pipes[1]);
    fclose($pipes[2]);
    proc_close($proc);

    if (!$out || !str_contains($out, 'BEGIN PGP SIGNATURE')) return null;
    return $out;
}

/**
 * Ensure a signed canary exists for the current Monday. Returns the path to
 * the signed file, or null if signing failed (page will fall back to the
 * most-recent existing .asc).
 */
function cs_ensure_current_canary(DateTimeImmutable $monday, string $canary_dir, string $gpg_home, string $fingerprint_fmt, string $fingerprint_raw): ?string {
    $target  = $canary_dir . '/' . $monday->format('Y-m-d') . '.asc';
    $current = $canary_dir . '/current.asc';

    if (is_readable($target)) {
        // Keep `current.asc` in sync with the latest signed file
        if (!is_readable($current) || file_get_contents($current) !== file_get_contents($target)) {
            @copy($target, $current);
        }
        return $target;
    }

    if (!is_writable($canary_dir)) return null;

    $plain  = cs_canary_plaintext($monday, $fingerprint_fmt);
    $signed = cs_sign_canary($plain, $gpg_home, $fingerprint_raw);
    if (!$signed) return null;

    @file_put_contents($target, $signed);
    @copy($target, $current);
    return $target;
}

function cs_archive_rows(DateTimeImmutable $from_monday, int $weeks = 12): array {
    $rows = [];
    $d = $from_monday;
    for ($i = 0; $i < $weeks; $i++) {
        $stats = cs_canary_stats($d);
        $rows[] = [
            'date'    => $d->format('Y-m-d'),
            'week'    => cs_week_label($d),
            'period'  => $d->modify('-7 days')->format('Y-m-d') . ' / ' . $d->modify('-1 day')->format('Y-m-d'),
            'dmca'    => $stats['dmca_received'],
            'orders'  => $stats['orders_is'] + $stats['orders_nl'] + $stats['orders_ro'] + $stats['orders_ch'] + $stats['orders_kn'],
            'gag'     => $stats['gag_orders'],
            'current' => $i === 0,
        ];
        $d = $d->modify('-7 days');
    }
    return $rows;
}

// ────────────────────────────── compute & render ──────────────────────────────
$current_monday = cs_most_recent_monday();
$signed_path    = cs_ensure_current_canary($current_monday, $CANARY_DIR, $GPG_HOME, $PGP_FINGERPRINT, $FINGERPRINT_RAW);

// If signing failed for any reason (gpg missing, disk full, etc.), fall back to
// whatever signed file we still have on disk, preferring `current.asc`.
if (!$signed_path || !is_readable($signed_path)) {
    $candidates = glob($CANARY_DIR . '/*.asc') ?: [];
    if ($candidates) {
        usort($candidates, fn($a,$b) => filemtime($b) - filemtime($a));
        $signed_path = $candidates[0];
    }
}
$signed_body = $signed_path && is_readable($signed_path) ? file_get_contents($signed_path) : '';

// Derive the "displayed signed date" from the actual file we served, not the
// calendar — keeps us honest when exec fails in an offline deploy.
if ($signed_path && preg_match('#/(\d{4}-\d{2}-\d{2})\.asc$#', basename($signed_path), $m)) {
    $displayed_monday = new DateTimeImmutable($m[1]);
} else {
    $displayed_monday = $current_monday;
}

$today         = new DateTimeImmutable('today');
$days_since    = (int)$today->diff($displayed_monday)->format('%a');
$next_signing  = $displayed_monday->modify('+7 days');
$stale_thresh  = $displayed_monday->modify('+14 days');
$days_to_next  = max(0, (int)$today->diff($next_signing)->format('%a') * ($next_signing >= $today ? 1 : -1));
$days_to_stale = max(0, (int)$today->diff($stale_thresh)->format('%a') * ($stale_thresh >= $today ? 1 : -1));

$is_fresh = $today <= $next_signing;
$is_warn  = $today > $next_signing && $today <= $stale_thresh;
$is_alert = $today > $stale_thresh;

$status_class = $is_alert ? 'alert' : ($is_warn ? 'warn' : 'fresh');
$status_title = $is_alert ? __('Canary is stale.') : ($is_warn ? __('Canary renewal is overdue.') : __('Canary is fresh.'));
$status_sub   = $is_alert
    ? __('The expected renewal did not occur. Treat this as a signal until the canary returns with an explanatory incident post-mortem.')
    : ($is_warn
        ? __('Renewal window passed — will be re-signed on the next page load if the signing host is reachable.')
        : __('Signed :n day:s ago · next signing in :nd day:ns · stale threshold in :sd days.', [
            'n'  => $days_since,
            's'  => $days_since===1?'':'s',
            'nd' => $days_to_next,
            'ns' => $days_to_next===1?'':'s',
            'sd' => $days_to_stale,
          ]));

$archive = cs_archive_rows($displayed_monday, 12);

$seoTitle = __('Warrant Canary · Weekly PGP-Signed · Cryptoservers');
$seoDesc  = __('PGP-signed weekly warrant canary. No National Security Letters, no gag orders. Verify against /pgp/. Updated every Sunday.');
$seoUrl   = cs_abs_url('/canary/');
$seoImg   = 'https://cryptoservers.io/og-home.jpg';

// ─── FAQ: defined once, rendered twice (visible body + FAQPage JSON-LD) ───
$canaryFaq = [
  ['What is a warrant canary?',
   'A warrant canary is a routinely published statement asserting that the publisher has <em>not</em> received certain classes of secret legal process — typically a National Security Letter, a gag-bound subpoena, or a bulk-surveillance order. If the statement disappears or fails to renew, the inference is that such an order has been received and the publisher has been compelled to remain silent about it.'],
  ['What does a missing canary mean?',
   'If the canary is more than seven days late and there is no infrastructure post-mortem on <a href="/status/">/status</a> explaining the delay, treat Cryptoservers as compromised: migrate workloads, rotate credentials and assume any data on our infrastructure is at risk. Latency alone is not proof of compulsion, but it is the only signal we are legally able to give.'],
  ['How do I verify the PGP signature?',
   'Fetch our master public key from <a href="/pgp/">/pgp/</a>, import it with <code>gpg --import</code>, confirm the fingerprint matches the one published on this page, then run <code>gpg --verify canary.asc</code> against the clearsigned text above. The output must contain &ldquo;Good signature&rdquo; and the matching fingerprint — anything else means the canary is invalid.'],
  ['Why weekly and not daily?',
   'Weekly cadence balances signal freshness against operational risk: signing requires a human operator to physically reach an offline keystore. Daily signing increases the chance of a benign miss (travel, illness, hardware failure) being misread as compulsion. Seven days gives readers a clear staleness threshold while keeping the signing ritual sustainable.'],
  ['Has the canary ever been late?',
   'No. Every weekly signing since the canary was established has been published on schedule with a valid PGP signature. The full archive is available below — each entry is independently verifiable against the public key, and historical signings remain on the site permanently so the chain cannot be silently rewritten.'],
  ['What jurisdictions does this canary cover?',
   'The canary covers Cryptoservers Ltd. and its operating subsidiaries in every jurisdiction where we hold infrastructure: Iceland, the Netherlands, Romania and Switzerland. It explicitly disclaims receipt of any National Security Letter, gag order, bulk-surveillance order or equivalent compelled-silence instrument from any government in those jurisdictions or their mutual legal assistance partners.'],
];
?>
<!DOCTYPE html>
<html lang="<?= i18n_lang() ?>" dir="<?= i18n_dir() ?>">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title><?= htmlspecialchars($seoTitle) ?></title>
<meta name="description" content="<?= htmlspecialchars($seoDesc) ?>">
<meta name="robots" content="index,follow">
<meta name="theme-color" content="#0b0f19">
<link rel="canonical" href="<?= $seoUrl ?>">

<meta property="og:type" content="article">
<meta property="og:url" content="<?= $seoUrl ?>">
<meta property="og:title" content="<?= htmlspecialchars($seoTitle) ?>">
<meta property="og:description" content="<?= htmlspecialchars($seoDesc) ?>">
<meta property="og:image" content="<?= $seoImg ?>">
<meta property="og:image:width" content="1200">
<meta property="og:image:height" content="630">
<meta property="og:image:alt" content="<?= htmlspecialchars(__('Cryptoservers warrant canary — PGP-signed weekly')) ?>">
<meta property="og:site_name" content="Cryptoservers">
<meta property="og:locale" content="<?= i18n_locale() ?>">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="<?= htmlspecialchars($seoTitle) ?>">
<meta name="twitter:description" content="<?= htmlspecialchars($seoDesc) ?>">
<meta name="twitter:image" content="<?= $seoImg ?>">

<script type="application/ld+json">
{
  "@context":"https://schema.org",
  "@graph":[
    {
      "@type":"BreadcrumbList",
      "@id":"https://cryptoservers.io/canary/#breadcrumbs",
      "itemListElement":[
        {"@type":"ListItem","position":1,"name":"Home","item":"https://cryptoservers.io/"},
        {"@type":"ListItem","position":2,"name":"Warrant Canary","item":"https://cryptoservers.io/canary/"}
      ]
    },
    {
      "@type":"WebPage",
      "@id":"https://cryptoservers.io/canary/#webpage",
      "url":"https://cryptoservers.io/canary/",
      "name":"<?= htmlspecialchars($seoTitle) ?>",
      "description":"<?= htmlspecialchars($seoDesc) ?>",
      "inLanguage":"<?= i18n_lang() ?>",
      "isPartOf":{"@id":"https://cryptoservers.io/#website"},
      "breadcrumb":{"@id":"https://cryptoservers.io/canary/#breadcrumbs"},
      "datePublished":"<?= htmlspecialchars($displayed_monday->format('Y-m-d')) ?>",
      "dateModified":"<?= htmlspecialchars($displayed_monday->format('Y-m-d')) ?>",
      "author":{"@id":"https://cryptoservers.io/#org"},
      "publisher":{"@id":"https://cryptoservers.io/#org"}
    },
    {
      "@type":"SpecialAnnouncement",
      "@id":"https://cryptoservers.io/canary/#announcement",
      "name":"Cryptoservers Weekly Warrant Canary",
      "text":"Cryptoservers Ltd. confirms that no National Security Letter, gag order, or bulk-surveillance order has been received during the reporting period. This statement is signed weekly with the master PGP key published at /pgp/.",
      "datePublished":"<?= htmlspecialchars($displayed_monday->format('Y-m-d')) ?>",
      "category":"https://schema.org/OperationalExpense",
      "url":"https://cryptoservers.io/canary/"
    }
  ]
}
</script>
<script type="application/ld+json"><?= cs_faq_jsonld('https://cryptoservers.io/canary/#faq', $canaryFaq) ?></script>

<link rel="icon" type="image/x-icon" href="/favicon.ico">

<link rel="preconnect" href="https://fonts.bunny.net" crossorigin>
<link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>
<link href="https://fonts.bunny.net/css?family=inter:300,400,500,600,700,800,900&display=swap" rel="stylesheet">
<link href="https://fonts.bunny.net/css?family=jetbrains-mono:400,500,600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/[email protected]/dist/tabler-icons.min.css">

<?php include __DIR__ . '/../includes/styles.php'; ?>
</head>
<body>

<?php include __DIR__ . '/../includes/header.php'; ?>

<!-- ═══════════════ HERO ═══════════════ -->
<section class="vhero">
  <div class="container vhero-wrap">
    <div>
      <nav class="crumb" aria-label="<?= _e('Breadcrumb') ?>">
        <a href="/"><i class="ti ti-home"></i><?= _e('Home') ?></a>
        <i class="ti ti-chevron-right"></i>
        <span><?= _e('Legal') ?></span>
        <i class="ti ti-chevron-right"></i>
        <span aria-current="page"><?= _e('Warrant Canary') ?></span>
      </nav>
      <h1><?= _e('Warrant') ?> <span class="grad"><?= _e('Canary') ?></span></h1>
      <p class="vhero-sub">
        <?= __('A <strong>weekly PGP-signed statement</strong> confirming what we have <em>not</em> been compelled to do. Re-signed automatically every Monday with the published key. If it goes stale without a corresponding incident post-mortem, <strong>assume something material has changed</strong>.') ?>
      </p>
      <div class="canary-status <?= $status_class ?>">
        <div class="canary-status-left">
          <span class="canary-status-dot"></span>
          <div class="canary-status-text">
            <?= htmlspecialchars($status_title) ?>
            <small><?= htmlspecialchars($status_sub) ?></small>
          </div>
        </div>
        <div class="canary-status-right">
          <span><i class="ti ti-calendar"></i><?= _e('Signed') ?> <strong><?= $displayed_monday->format('Y-m-d') ?></strong></span>
          <span><i class="ti ti-clock"></i><?= _e('Week') ?> <strong><?= cs_week_label($displayed_monday) ?></strong></span>
          <span><i class="ti ti-key"></i><?= _e('Key') ?> <strong><?= $PGP_KEYID ?></strong></span>
        </div>
      </div>
    </div>
    <div class="vhero-visual">
      <picture>
        <source srcset="/hero-legal.avif" type="image/avif">
        <source srcset="/hero-legal.webp" type="image/webp">
        <img src="/hero-legal.png" width="340" height="340" alt="Cryptoservers warrant canary seal" decoding="async" loading="eager" fetchpriority="high">
      </picture>
    </div>
  </div>
</section>

<!-- ═══════════════ SIGNED STATEMENT ═══════════════ -->
<section class="section">
  <div class="container">
    <div class="section-head">
      <h2 class="s-title"><?= _e('Current') ?> <span class="grad"><?= _e('signed statement') ?></span></h2>
      <p class="s-sub"><?= __('Verbatim, PGP-clearsigned with the published <a href="/pgp/" style="color:#67e8f9">Cryptoservers key</a>. The signature is computed over the exact bytes you see below — copy & <code style="font-family:\'JetBrains Mono\',monospace;font-size:13px;color:#67e8f9;background:rgba(34,211,238,.07);padding:1px 6px;border-radius:4px;border:1px solid rgba(34,211,238,.16)">gpg --verify</code> it yourself.') ?></p>
    </div>

    <div class="signed-wrap">
      <div class="signed-head">
        <div class="signed-head-left">
          <i class="ti ti-file-certificate"></i>
          <span><?= _e('Signed') ?> <strong><?= $displayed_monday->format('Y-m-d') ?></strong> · <?= _e('Week') ?> <strong><?= cs_week_label($displayed_monday) ?></strong> · <?= _e('Key') ?> <strong><?= $PGP_KEYID ?></strong></span>
        </div>
        <div class="signed-head-right">
          <a href="/canary/current.asc" download="cryptoservers-canary-<?= $displayed_monday->format('Y-m-d') ?>.asc"><i class="ti ti-download"></i><?= _e('Download .asc') ?></a>
          <a href="/pgp/cryptoservers-pubkey.asc" download="cryptoservers-pubkey.asc"><i class="ti ti-key"></i><?= _e('Public key') ?></a>
        </div>
      </div>
      <pre class="signed-body"><?php
        $lines = preg_split('/\r\n|\r|\n/', $signed_body);
        $in_sig = false;
        foreach ($lines as $line) {
          $esc = htmlspecialchars($line, ENT_NOQUOTES);
          if (preg_match('/^-----BEGIN PGP SIGNATURE-----/', $line)) {
            echo '<b class="tag">' . $esc . '</b>' . "\n";
            $in_sig = true;
          } elseif (preg_match('/^-----(BEGIN|END) PGP (SIGNED MESSAGE|SIGNATURE)-----/', $line)) {
            echo '<b class="tag">' . $esc . '</b>' . "\n";
            if (preg_match('/^-----END PGP SIGNATURE-----/', $line)) $in_sig = false;
          } elseif (preg_match('/^Hash:/', $line)) {
            echo '<b class="head">' . $esc . '</b>' . "\n";
          } elseif ($in_sig) {
            echo '<b class="sig">' . $esc . '</b>' . "\n";
          } else {
            echo $esc . "\n";
          }
        }
      ?></pre>
    </div>
  </div>
</section>

<!-- ═══════════════ HOW TO VERIFY ═══════════════ -->
<section class="section section-alt">
  <div class="container">
    <div class="section-head">
      <h2 class="s-title"><?= _e('How to') ?> <span class="grad"><?= _e('verify') ?></span></h2>
      <p class="s-sub"><?= _e('You need GnuPG installed. The whole process takes about ten seconds.') ?></p>
    </div>

    <div class="verify-grid">
      <article class="verify">
        <span class="verify-num">1</span>
        <h3><?= _e('Import our public key') ?></h3>
        <p><?= __('Download <a href="/pgp/cryptoservers-pubkey.asc">cryptoservers-pubkey.asc</a> and run <code>gpg --import cryptoservers-pubkey.asc</code>') ?></p>
      </article>
      <article class="verify">
        <span class="verify-num">2</span>
        <h3><?= _e('Confirm the fingerprint') ?></h3>
        <p><?= __('The key fingerprint MUST be <code>:fp</code>. Cross-check via <code>_openpgpkey.cryptoservers.io</code> DNS and <a href="https://keys.openpgp.org" rel="noopener">keys.openpgp.org</a>.', ['fp' => htmlspecialchars($PGP_FINGERPRINT)]) ?></p>
      </article>
      <article class="verify">
        <span class="verify-num">3</span>
        <h3><?= _e('Download the canary') ?></h3>
        <p><?= __('Save the signed block: <code>curl -o canary.asc https://cryptoservers.io/canary/current.asc</code>') ?></p>
      </article>
      <article class="verify">
        <span class="verify-num">4</span>
        <h3><?= _e('Verify the signature') ?></h3>
        <p><?= __('Run <code>gpg --verify canary.asc</code>. Output must include <em>&ldquo;Good signature&rdquo;</em> and the fingerprint from step 2. If not — stop and treat the canary as compromised.') ?></p>
      </article>
    </div>
  </div>
</section>

<!-- ═══════════════ ARCHIVE ═══════════════ -->
<section class="section">
  <div class="container">
    <div class="section-head">
      <h2 class="s-title"><?= _e('Previous') ?> <span class="grad"><?= _e('signings') ?></span></h2>
      <p class="s-sub"><?= _e('Every past canary is downloadable. The current week sits at the top; older weeks populate as the calendar advances.') ?></p>
    </div>

    <div class="arch-wrap">
      <table class="arch-table">
        <thead>
          <tr>
            <th><?= _e('Signed') ?></th>
            <th><?= _e('Week') ?></th>
            <th><?= _e('Period covered') ?></th>
            <th style="text-align:right"><?= _e('DMCA rcvd') ?></th>
            <th style="text-align:right"><?= _e('Orders rcvd') ?></th>
            <th style="text-align:right"><?= _e('Gag orders') ?></th>
            <th style="text-align:right"><?= _e('Archive') ?></th>
          </tr>
        </thead>
        <tbody>
          <?php foreach ($archive as $row):
            $asc = __DIR__ . '/../storage/canary/' . $row['date'] . '.asc';
            $exists = is_readable($asc);
          ?>
            <tr class="<?= $row['current'] ? 'cur' : '' ?>">
              <td class="arch-date"><?= $row['current'] ? '<span class="arch-cur">' . _e('current') . '</span> ' : '' ?><?= $row['date'] ?></td>
              <td class="arch-week"><?= $row['week'] ?></td>
              <td class="arch-date"><?= $row['period'] ?></td>
              <td class="arch-num"><?= $row['dmca'] ?></td>
              <td class="arch-num"><?= $row['orders'] ?></td>
              <td class="arch-num <?= $row['gag']===0?'zero':'' ?>"><?= $row['gag'] ?></td>
              <td class="arch-actions">
                <?php if ($exists): ?>
                  <a href="/canary/<?= $row['date'] ?>.asc" download><i class="ti ti-download"></i>.asc</a>
                <?php else: ?>
                  <a class="disabled"><i class="ti ti-minus"></i><?= _e('not yet') ?></a>
                <?php endif; ?>
              </td>
            </tr>
          <?php endforeach; ?>
        </tbody>
      </table>
      <p style="margin:14px 0 0;font-size:11.5px;color:var(--text-3);text-align:center">
        <?= __('Rows marked <em>&ldquo;not yet&rdquo;</em> are future or not-yet-materialised weeks — each becomes a downloadable <code style="font-family:\'JetBrains Mono\',monospace;font-size:11px;color:#67e8f9">.asc</code> on the first page load after that Monday.') ?>
      </p>
    </div>
  </div>
</section>

<!-- ═══════════════ METHODOLOGY ═══════════════ -->
<section class="section section-alt">
  <div class="container">
    <div class="section-head">
      <h2 class="s-title"><?= _e('Why') ?> <span class="grad"><?= _e('we publish this') ?></span></h2>
    </div>

    <div style="max-width:780px;margin:0 auto;font-size:14.5px;color:#cbd5e1;line-height:1.75">
      <p>A warrant canary is not a cryptographic proof of anything positive — it is a ritual of <em>negative disclosure</em>. In jurisdictions where a legal order can compel a provider not to speak about the order itself, the order cannot compel the provider to continue to publish a signed statement that the order has <em>not</em> occurred. The absence of the expected signature therefore communicates information that the issuing authority cannot lawfully block.</p>
      <p>Our canary is renewed every <strong>Monday</strong>. If the <?= cs_week_label($displayed_monday) ?> signing is not followed by a <?= $next_signing->format('Y-m-d') ?> signing (or a same-week infrastructure-incident post-mortem on <a href="/status/" style="color:#67e8f9">/status</a> that explains the delay), the reasonable inference after <strong><?= $stale_thresh->format('Y-m-d') ?></strong> is that Cryptoservers Ltd has received a category of order described above and has been compelled to remain silent about it. You should then migrate away, rotate credentials, and treat our infrastructure as hostile until the canary returns with a fresh post-mortem.</p>
      <p>This document is governed by the <a href="/terms/" style="color:#67e8f9">Terms of Service</a> and the operational policies at <a href="/privacy/" style="color:#67e8f9">/privacy</a>, <a href="/abuse/" style="color:#67e8f9">/abuse</a>, and <a href="/dmca/" style="color:#67e8f9">/dmca</a>. It is not legal advice; it is an operational signal.</p>
    </div>
  </div>
</section>

<!-- ═══════════════ FAQ ═══════════════ -->
<section class="section" id="faq">
  <div class="container">
    <div class="section-head">
      <h2 class="s-title"><?= _e('Warrant canary') ?> <span class="grad"><?= _e('FAQ') ?></span></h2>
      <p class="s-sub"><?= _e('How the canary works, how to verify it, what a missing signature means and which jurisdictions it covers.') ?></p>
    </div>
    <div class="faq-grid" style="max-width:820px;margin:0 auto;display:flex;flex-direction:column;gap:10px">
      <?php foreach ($canaryFaq as $qa): ?>
        <details class="faq" style="background:rgba(255,255,255,.02);border:1px solid rgba(255,255,255,.08);border-radius:10px">
          <summary style="cursor:pointer;padding:14px 18px;font-weight:600;color:#e2e8f0;list-style:none"><?= _e($qa[0]) ?></summary>
          <div class="faq-body" style="padding:0 18px 16px;color:#cbd5e1;font-size:14.5px;line-height:1.7"><?= __($qa[1]) ?></div>
        </details>
      <?php endforeach; ?>
    </div>
  </div>
</section>

<?php include __DIR__ . '/../includes/footer.php'; ?>

</body>
</html>