Check a supply chain against sellers.json and ads.txt

A bid request's Source.schain lists every company that touched the impression. Buyers trust it only when each hop matches what that company publishes in sellers.json and the publisher authorizes in ads.txt or app-ads.txt. The rtblint CLI checks all of it offline.

Run the check

Put the files you want to check against in a cache directory with this layout:

cache/
  sellers/<asi>/sellers.json        one per SupplyChain node domain
  ads/<site.domain>/ads.txt         web inventory
  app-ads/<app.bundle>/app-ads.txt  app inventory

Then validate the request with resolution turned on:

cargo install rtblint
rtblint validate --resolve --cache ./cache request.json

Nothing is fetched from the network; the pass reads only the cache. Add --format json for machine-readable output in CI.

What it reports

Finding	Meaning
`openrtb.resolve.sid_not_in_sellers`	A node's sid is missing from the sellers.json at its asi domain.
`openrtb.resolve.sellers_json_unavailable`	The cache has no sellers.json for a node's asi domain.
`openrtb.resolve.sellers_json_unparseable`	The cached sellers.json is not valid JSON in the expected shape.
`openrtb.resolve.ads_txt_unauthorized`	The publisher's ads.txt does not authorize the selling account.
`openrtb.resolve.ads_txt_unavailable`	The cache has no ads.txt for the site domain.
`openrtb.resolve.app_ads_txt_unauthorized`	The app's app-ads.txt does not authorize the selling account.
`openrtb.resolve.app_ads_txt_unavailable`	The cache has no app-ads.txt for the app bundle.

The structural checks on the chain itself (duplicate nodes, a missing SupplyChainNode.hp, an incomplete chain) run without --resolve, in the tester and the CLI.

Background

Supply chain (schain): the object and its fields.
ads.txt, sellers.json, and schain: how the three fit together.
The supply chain trust stack: what each layer proves.

Questions people ask

Why does the check need local files?

The validator core never touches the network, so results are reproducible and nothing about your traffic leaves your machine. You fetch the sellers.json, ads.txt, and app-ads.txt files once into a cache directory, and the check reads them from there.

What does a sid_not_in_sellers finding mean?

A SupplyChain node names a seller ID that the sellers.json published at that node's asi domain does not list. Either the chain is wrong or the sellers.json is stale; buyers treat the hop as unverified either way.

Is there a hosted version?

Not yet. A hosted check would have to fetch third-party files on your behalf and cache them, so for now the check runs locally with the CLI.