Skip to content

Download sample verification kit

Download a compact sample verifier bundle to inspect the manifest, receipt, and offline verification flow before starting Pilot or Activation.

Download

attestlayer-sample-kit.zip

ZIP SHA-256a28034e43581d131c2bcc4f896a63248219d1695024f8f27378f468e81dd474c
Manifest Root Hashd193ade0443e986f9903b4d0dbd5395632bdb715dae8130f509fd6315730106c
SchemaMANIFEST-02 / FES-1.0
Receipt Key ID8adefa300a1059bc
Bundle Typecompact sample verifier bundle
Download Sample KitVerify Sample Kit

What to Look For

Inside this compact sample bundle (flat ZIP, 11 files):

  • START-HERE.pdf — quick orientation for the demo bundle
  • manifest.json — SHA-256 file index with root hash (MANIFEST-02)
  • receipt.json — Ed25519 signed receipt (FES-1.0, kid: 8adefa300a1059bc)
  • artifacts/sample-binder.pdf — 5-page sample evidence binder
  • jwks.json — issuer public key for offline verification
  • mapping.json — file role descriptions
  • verifier/index.html — browser-based offline verifier
  • verifier/app.js — verifier logic
  • verifier/README.md — verifier instructions
  • README-FIRST.md — kit overview and verification instructions

The jwks.json in this kit is the issuer.jwks.json (receipt signing). The separate registry JWKS (registry.jwks.json) is used for checkpoint verification only.

How Live PASS Delivery Differs

Production PASS delivery returns the real output contract: kit.zip plus standalone passfail.json, mapping.json, classification_report.json, normalized_tree.zip, and optional diff.json.

Inside the production kit.zip, files are packaged under kit/, including kit/artifacts/, kit/manifest.json, kit/receipt.json, kit/receipt.sig, kit/registry/registry_receipt.json, and the bundled verifier with kit/verifier/jwks.json.

Inspect Artifacts Individually

manifest.jsonreceipt.json

How to Verify

  1. Download the sample kit above.
  2. Go to verify.attestlayer.com and upload the ZIP.
  3. The verifier checks every SHA-256 hash in the manifest and verifies the Ed25519 receipt signature.
  4. Or use the bundled verifier from the ZIP; signature verification still trusts the registry JWKS.

← Back to home