{
  "$comment": "Describes what can and cannot be established about the object below. Read 'registration' before relying on anything here.",
  "manifest_version": 1,
  "statement_date": "2026-08-19",
  "object": {
    "id": "936c81c388472c8b4d1a476ac126ef09f1b088cee13d93aa1cb3deea894130cb",
    "id_alg": "sha-256",
    "file": "signed-statement.cose",
    "media_type": "application/cose",
    "bytes": 1675,
    "structure": "COSE_Sign1 (RFC 9052 s4.4), ES256"
  },
  "detached": {
    "file": "signed-statement-detached.cose",
    "media_type": "application/cose",
    "bytes": 131,
    "sha256": "378853de5f0d36f82b931c12abed7a4bb780fe292f5c0701c6e3a4810c184bf9",
    "note": "Same signature, payload omitted. Verifies against subject-cbom.json."
  },
  "subject": {
    "file": "subject-cbom.json",
    "media_type": "application/vnd.cyclonedx+json",
    "bytes": 1542,
    "sha256": "7fd8cb263d72885d0da8510cf81d1936a70196826f2e1612c28c7735551874b1",
    "spec": "CycloneDX 1.7 CBOM",
    "provenance": "Third-party document, unmodified, from the official CycloneDX examples repository (CycloneDX/bom-examples, CBOM/Example-With-Dependencies/bom.json). Chosen deliberately: signing a document we did not author is what demonstrates carrier independence."
  },
  "issuer": {
    "name": "Tyche Institute MTU",
    "country": "EE",
    "registry_code": "80673227",
    "key_file": "issuer-public-key.pem",
    "key_sha256": "34081aa6aa7e01431e769bcc7158f0d551f46d5824f4683c9670c821e934ac91",
    "kid": "tyche-demo-2026-08-19",
    "note": "Demonstration key. It attests authorship of this statement and nothing else. Not a qualified certificate, not a trust-service key, bound to no accreditation."
  },
  "what_this_establishes": [
    "That the holder of the key in issuer-public-key.pem asserted the exact bytes of subject-cbom.json.",
    "That neither payload nor signature has been altered since, because either alteration makes verification fail closed."
  ],
  "what_this_does_not_establish": [
    "That the statement was submitted anywhere.",
    "That it appears in any transparency log.",
    "That the issuer is accredited, supervised, or trusted by anyone.",
    "Anything about the correctness of the CBOM's contents."
  ],
  "registration": null,
  "registration_note": "No transparency service has been selected for this statement, so no receipt exists. A receipt requires submission to a transparency service and inclusion in its log; there is no honest way to produce one locally. Selecting that service is an open item of the PKI Consortium CBOM Profiles Working Group as of its meeting of 19 August 2026. This field carries a receipt when, and only when, one has been issued.",
  "verification": {
    "verifier": "verify.py",
    "verifier_sha256": "23205b216c47404796195a864f357ea91a40f7cc5b76d15431f5d0c5dff3ea61",
    "requires_network": false,
    "how": "Download all five files into one directory and run: python3 verify.py",
    "expected_output": "VERIFIED OFFLINE (exit 0). Any tampering exits non-zero.",
    "dependencies": "python3 with cbor2 and cryptography",
    "note": "This surface does not verify anything for you and exposes no verify endpoint on purpose. A server answering 'valid' is a claim you must trust; a file you check yourself is not."
  }
}