Inspect the portable package
The ZIP should contain a manifest, manifest signature, and the exported artifacts needed to review the certified archive away from the live system.
Trust Bundle reviewer guide
Portable evidence assurance
Trust Bundle reviewer guide
This guide applies to original or legacy Trust Bundles you legitimately hold. Verify their manifest and artifact hashes locally. Anonymous creation or download of a full canonical bundle is restricted.
Bundle protocol
The Trust Bundle separates package inventory, manifest integrity, registry signature, and artifact reconciliation so reviewers can explain what was received and whether it still matches the export.
Recompute the manifest SHA-256
The verifier hashes manifest.json locally and can compare it with an expected export hash from the registry or audit packet.
Verify the registry signature
The manifest signature is checked against the public signing-key registry so the package inventory can be tied to the Futbolier registry issuer.
Reconcile each artifact
Every artifact listed in the manifest is checked for presence, byte size, and SHA-256 match before the bundle is accepted as a complete package.
Trust model
The Trust Bundle is a portable evidence package. It does not replace the registry, certificate, receipt, or payload verifier; it packages those artifacts and proves whether the package still matches its manifest.
The bundle preserves a handoff package
A verified bundle means the exported files still match the manifest inventory that accompanied the certified archive review packet.
The manifest anchors package integrity
Manifest SHA-256 and registry signature checks explain whether the package inventory is intact and whether the signing key can be resolved.
Each artifact keeps its own trust boundary
The receipt communicates trust, the registry establishes standing, the technical certificate records evidence, and the payload verifier checks byte-level integrity.
Bundle review runbook
Follow this sequence when reviewing a Trust Bundle export in a federation handoff, dispute packet, or offline audit file.
1
Collect the bundle and expected manifest
Use the ZIP file and any supplied manifest SHA-256, registry export record, or handoff receipt without renaming or altering the package.
2
Run local bundle verification
Upload the ZIP to the verifier. The browser reads the package locally and recomputes the manifest and artifact hashes.
3
Review manifest and signature status
Confirm the expected manifest match, registry signature status, signing key ID, public key SHA-256, and key registry endpoint.
4
Review artifact results
Check that every expected artifact is present and hash-matched, and preserve any missing, mismatched, or unexpected file details.
5
Preserve the verification session
Keep the session receipt, uploaded manifest hash, expected manifest hash, artifact statuses, registry issuer, and verification timestamp.
Expected artifact stack
The bundle is useful because it carries adjacent trust layers together. Reviewers should still interpret each artifact using its own guide and authority boundary.
Public trust receipt
Readable public handoff artifact, PDF, QR, or URL showing the certified archive and trust signals.
Registry verification report
Lookup context, archive standing, certification metadata, fingerprint comparison, and public registry receipt.
Technical certificate
This guide applies to original or legacy Trust Bundles you legitimately hold. Verify their manifest and artifact hashes locally. Anonymous creation or download of a full canonical bundle is restricted.
Canonical payload
Inspectable JSON contract used for SHA-256 recomputation and independent payload verification.
Manifest and signature
Package inventory, artifact SHA-256 values, manifest signature, signing key ID, and public key registry reference.
Bundle interpretation
Bundle signals explain whether the package can be retained as portable evidence or whether it needs reconciliation before handoff.
Bundle signal
Trust Bundle verified
Meaning
The manifest signature verifies and every listed artifact is present with a matching SHA-256.
Audit treatment
Portable evidenceBundle signal
Review required
Meaning
The expected files match, but the bundle includes unexpected files or non-blocking review items.
Audit treatment
Review packageBundle signal
Manifest mismatch
Meaning
The uploaded manifest SHA-256 differs from the expected export hash supplied for the review.
Audit treatment
Package mismatchBundle signal
Artifact exception
Meaning
A listed artifact is missing, has a different SHA-256, or cannot be reconciled to the manifest.
Audit treatment
Incomplete packageBundle signal
Signature or key exception
Meaning
The registry signature, signing key, public key fingerprint, or key registry lookup could not be fully verified.
Audit treatment
Signature review| Bundle signal | Meaning | Audit treatment |
|---|---|---|
| Trust Bundle verified | The manifest signature verifies and every listed artifact is present with a matching SHA-256. | Portable evidence |
| Review required | The expected files match, but the bundle includes unexpected files or non-blocking review items. | Review package |
| Manifest mismatch | The uploaded manifest SHA-256 differs from the expected export hash supplied for the review. | Package mismatch |
| Artifact exception | A listed artifact is missing, has a different SHA-256, or cannot be reconciled to the manifest. | Incomplete package |
| Signature or key exception | The registry signature, signing key, public key fingerprint, or key registry lookup could not be fully verified. | Signature review |
Evidence to retain
A complete Trust Bundle review file should preserve the ZIP, manifest hash evidence, signature context, artifact verification results, registry context, and session receipt.
Trust Bundle ZIP
Store the exact ZIP file received for the review, including its filename and source handoff context.
Manifest SHA-256 evidence
Record the expected manifest hash, uploaded manifest hash, comparison result, and registry export source.
Manifest signature and key registry
Preserve signature status, issuer, key ID, public key SHA-256, key registry URL, and any key status warnings.
Artifact verification report
Keep per-file expected SHA-256, actual SHA-256, byte counts, missing files, mismatches, and unexpected files.
Registry and certificate context
Retain certificate ID, match ID, registry region, public data plane, and linked registry or certificate reports.
Verification session receipt
Save the local or public session receipt, verification timestamp, reviewer context, and any retry or recording status.
Exception handling
Bundle exceptions should be treated as package reconciliation work until the manifest, signature, artifact list, or source export is resolved.
For manifest mismatches, preserve the uploaded ZIP, expected hash source, uploaded manifest hash, and session receipt before escalating.
For missing or hash-mismatched artifacts, compare the registry report, technical certificate, canonical payload, and original export source.
For signature or key registry exceptions, preserve the key ID, public key SHA-256, key registry response, and signature status.
If the bundle is historical, stale, or tied to a superseded archive, inspect the current official archive before treating the bundle as operative.