Offline Verifier

The dependency-free Node.js verifier accepts accessibility conformance V1 and historical capture V2 .reshot-pack files. It does not call Reshot.

node applications/record-verifier/verify.mjs ./conformance.reshot-pack \
  --trust-roots ./reshot-trusted-roots.json \
  --key-registry ./reshot-current-key-registry.json \
  --tsa-ca ./tsa-root-bundle.pem \
  --tsa-untrusted ./tsa-intermediates.pem \
  --tsa-policy 1.2.3.4.5

Obtain every trust input independently of the pack. The verifier does not trust an embedded public key or archived registry merely because the pack contains it.

Strict result

Exit code 0 requires all of the following:

1. every inventory entry exists and matches its decoded size and SHA-256
2. the conformance record identity, revision, and template match the signed body
3. evidence inventory, provenance, and content addresses are complete
4. the content commitment matches the record and retained evidence set
5. the origin signature resolves through an independently pinned root and current registry
6. both RFC-3161 responses validate their imprint, signer purpose, certificate chain, and required policy

Any missing trust input, unsupported format, tampered byte, revoked signer, bad timestamp, or semantic mismatch exits 1.

Integrity-only diagnostic

node applications/record-verifier/verify.mjs ./conformance.reshot-pack --integrity-only

This checks internal byte consistency only. It does not assert origin or time trust and is labelled non-verifying in its output.

Local GA creates ephemeral signer and TSA hierarchies and runs both a valid strict verification and a tamper-negative proof. Those roots are marked local GA only and must never be used for production evidence.

See the Manifest Specification for the wire format.