Proof Bundles

attestation.dpiv
├── envelope.json        # The canonical envelope JSON
├── envelope.hash        # SHA-256 of envelope.json (canonicalized)
├── issuer.pem           # The issuer's public key
├── issuer.sig           # The issuer signature over envelope.hash
├── tsa-digicert.tsr     # RFC 3161 timestamp token from DigiCert
├── tsa-sectigo.tsr      # RFC 3161 timestamp token from Sectigo
├── inclusion.json       # Merkle inclusion proof (audit path)
├── sth.json             # The signed tree head
├── master.pem           # The chain-master public key
├── master.sig           # Master signature over sth.json
├── onchain.json         # Base L2 anchor metadata (if onchain mode)
├── verify.sh            # POSIX-sh verification script
├── README.md            # Human-readable explanation
└── manifest.sha256sum   # SHA-256 of every file above

curl -L -o attestation.dpiv \
  https://api.deepidv.com/v1/bundle/{attestation_id}

# Unzip the bundle
unzip attestation.dpiv -d ./bundle

# Run the verifier
cd bundle && ./verify.sh

# Output:
# [OK] Envelope hash matches
# [OK] Issuer signature valid
# [OK] TSA tokens valid (DigiCert + Sectigo)
# [OK] Merkle inclusion proof valid
# [OK] Master STH signature valid
# [OK] On-chain anchor present (tx 0x...)
#
# Bundle verified.