How to verify this package

Online (30 seconds)
  1. Go to https://testmode---verify-web-5zr72dduea-nn.a.run.app
  2. Upload 07-signed-receipt.json and 06-canonical-manifest.json from this package (Package ID: BRP-SAMPLE-2026-08-0001-F1)
  3. The page shows "Verified" with the issue date and the list of files, or "Not verified".

Offline
  1. 09-checksums.txt lists the SHA-256 of every file in this package. Recompute them:
       Windows:  certutil -hashfile <file> SHA256
       macOS/Linux:  shasum -a 256 <file>
     Every value must match.
  2. 06-canonical-manifest.json lists the same hashes with the package details.
     07-signed-receipt.json contains an Ed25519 signature over the receipt, including the manifest hash.
     Signing key id: attestlayer-brp-sample-2026-08-0001. SHA-256 fingerprint: 183422c02c55c382f635a13e62818fe5cf6501f0dbea67ca2c03847bd8a88825.
     Sample-only issuer JWKS (not a production key): https://testmode---verify-web-5zr72dduea-nn.a.run.app/sample/BRP-SAMPLE-2026-08-0001/issuer-sample.jwks.json
  3. Download the published JWKS as issuer-sample.jwks.json and run: python3 VERIFY_PACKAGE.py buyer-review-pack.zip issuer-sample.jwks.json

What verification proves
  That these files match the signed package receipt and the trusted issuer key for this Package ID.
  It does not assess the content of the responses; that responsibility stays with the issuing organization.
