RFC 9116 compliance

Contact (required)

At least one Contact: field containing a URI. Web contacts must use https://; mailto: and other valid URI schemes are preserved according to their syntax.

Expires (required)

Exactly one RFC 3339 date-time with a timezone, in the future. Flowpane warns if it is within 30 days and recommends review when it is more than one year ahead.

Optional fields

• Encryption — PGP key link
• Acknowledgments — hall of fame URL
• Preferred-Languages — e.g. en, fr, de
• Canonical — canonical URL of the file itself
• Policy — vulnerability disclosure policy URL
• Hiring — security job openings URL

Review authored contact and policy information before publication. The assessment does not cryptographically verify OpenPGP signatures or establish signer trust.

Scope of the assessment

The external requirements are defined by RFC 9116. Flowpane reports findings about the obtained representation and fields; use the full specification and your disclosure policy when authoring a file. Correct syntax does not prove that a contact responds, a policy is suitable or a signature is trusted.

For example, updating Expires may address a date finding while leaving an obsolete contact unresolved. Review both before publication and check the well-known public location afterwards.