VERITROOPER — PACKAGE VERIFICATION
==================================================

This package is sealed with a standards-based digital signature covering every
delivered audit artifact (everything OUTSIDE this Integrity/ folder), linked to
VERITROOPER's canonical result hash.

WHAT EACH FILE IS
  Integrity/manifest.json   Lists every audit artifact + its SHA-256 (the signed payload).
  Integrity/manifest.p7s    Detached CMS/PKCS#7 signature over manifest.json's exact bytes.
  Integrity/signer_cert.pem The signer's certificate (public key). SELF-SIGNED — see TRUST below.
  Integrity/timestamp.tsr   RFC 3161 trusted timestamp (if present).
  Integrity/tsa_chain.pem   The timestamp authority's chain (trust its ROOT from your own store).

WHAT IS SIGNED / TIMESTAMPED
  The signature covers the exact bytes of Integrity/manifest.json.
  No trusted timestamp was attached, so this package's DATE is SELF-ASSERTED.
  A trusted date can be added later without invalidating this seal — the
  authority only needs the manifest digest above, so nothing about the audit
  has to leave your network:
      python vt.py timestamp "<this package folder>"
  Manifest SHA-256: 9ccc81527cec2cbaaa82392db3089bbdf6e9ec59a4cbcc6fbed9111f3e1f7d26

VERIFY WITH THE BUNDLED TOOL (if Integrity/ contains vt_verify.exe or vt_verify.py)
  Double-click "Check this package.bat", or run:  vt_verify.exe <this-folder>
  If those files are not present, use the OpenSSL steps below, or run
  `python vt.py verify <this-folder>` from a VERITROOPER install
  (add  --trust BE:D1:4C:7B:27:D4:CF:4D:17:76:08:4A:3E:43:60:62:E9:CD:6A:2E:3C:DB:1A:44:C5:3F:15:E1:54:54:A7:39  ONLY if you obtained that
   fingerprint through a trusted out-of-band channel — see TRUST below.)

VERIFY WITH STANDARD OPENSSL
  Signature:  openssl cms -verify -binary -inform DER -in Integrity/manifest.p7s \
                 -content Integrity/manifest.json -certfile Integrity/signer_cert.pem \
                 -noverify -out verified_manifest.json
  Timestamp:  openssl ts -verify -data Integrity/manifest.json \
                 -in Integrity/timestamp.tsr -CAfile <your-trusted-tsa-ca.pem>
  Then confirm each file's SHA-256 matches Integrity/manifest.json.

TRUST (IMPORTANT)
  The signer certificate is SELF-SIGNED. A valid signature proves the package was
  signed by the key whose certificate is included here and has not been altered
  since. It does NOT by itself prove the signer is Veritrooper LLC or your own
  organization. Establish that only by matching the signer fingerprint

      BE:D1:4C:7B:27:D4:CF:4D:17:76:08:4A:3E:43:60:62:E9:CD:6A:2E:3C:DB:1A:44:C5:3F:15:E1:54:54:A7:39

  against a record you obtained SEPARATELY (pilot agreement, onboarding document,
  a signed email, or a published verification page). If it matches, the package
  came from that registered signer. If you have no such record, treat identity as
  UNVERIFIED even when the signature is mathematically valid.
