AttestLayer AttestLayer
Contact

Offline Buyer Review Pack verification

Recalculate every package-file SHA-256, confirm the canonical manifest commitment in the signed receipt, then verify the Ed25519 signature against a trusted AttestLayer issuer JWKS obtained separately from the package.

Policy version: 2026-09-25

Issuer-key boundary: Packages are checked against AttestLayer's published key sets. A package signed by AttestLayer's test environment is identified as a test package, not a production one. Trust boundary: a package cannot establish its own trust. Do not trust a public key merely because it is bundled inside the ZIP. Registry issuer-key publication supports signature verification; it does not mean the answers are true. A package is not recorded in a public log.

Before disconnecting

  1. Download the Buyer Review Pack ZIP from the supplier.
  2. Obtain the applicable AttestLayer issuer JWKS separately from this verifier's environment-bound JWKS download. You may instead use another trusted channel your organization controls.
  3. Record the public JWKS download URL, retrieval time, and SHA-256 so the trust input is reviewable later. The current exact hash, retrieval time, refresh time, and expiry are published in /offline/metadata.json.

Download verifier v1.0 · Download issuer JWKS · View hashes and refresh metadata

One-time dependency setup: create an isolated Python environment and install the verifier's pinned dependency: python3 -m venv attestlayer-verify-env && . attestlayer-verify-env/bin/activate && python3 -m pip install cryptography==50.0.0. Confirm the installed version with python3 -c "import cryptography; print(cryptography.__version__)".

Before use, compare the downloaded verifier SHA-256 with /offline/metadata.json. Then run exactly: python3 attestlayer-brp-offline-verifier-v1.0.py buyer-review-pack.zip --jwks attestlayer-issuer.jwks.json

What to check offline

  1. Extract into a new empty directory and reject unsafe or duplicate paths.
  2. Recalculate every manifest-listed file hash and reject missing, extra, or changed entries.
  3. Recalculate the canonical manifest SHA-256 and confirm the receipt commits to it and the same package identifier.
  4. Resolve the receipt key ID only in the separately obtained JWKS and validate the Ed25519 signature.

How to interpret the result

A successful result confirms package integrity and issuer-key binding. It does not prove the underlying records are true, complete, current, lawful, compliant, or acceptable to a buyer. It is not an audit, certification, security assessment, legal opinion, or buyer approval.

Freshness: an offline snapshot can become stale. Refresh issuer material online before relying on it after the published refresh date, and refresh sooner when key revocation or rotation may have occurred.

For the browser verifier, return to verify.attestlayer.com.

Verify is a public, read-only verification surface. It does not create a paid service relationship on its own.