{
  "attestation_version": 1,
  "manifest_sha256": "8f9b828b8608c8e3114f63f2ad0ddbde72f78005eaec56871e5c3a02a71f4d67",
  "authority": {
    "id": "aruba",
    "operator": "Aruba PEC S.p.A.",
    "jurisdiction": "IT",
    "qualified": true
  },
  "gen_time": "2026-09-15T00:37:29.000Z",
  "token_sha256": "09081e699f562af50fa3f30861a0b272fed20fe432483ebc696aa6367a95c20e",
  "token_base64": "MIILYwYJKoZIhvcNAQcCoIILVDCCC1ACAQMxDzANBglghkgBZQMEAgEFADCBnAYLKoZIhvcNAQkQAQSggYwEgYkwgYYCAQEGBgQAj2cBATAxMA0GCWCGSAFlAwQCAQUABCCPm4KLhgjI4xFPY/KtDdvecveABersVoceXDoCpx9NZwIIa8npjbE9uTMYDzIwMjYwOTE1MDAzNzI5WjADAgEBAgkA2f19B3ms9BehGzAZBggrBgEFBQcBAwQNMAswCQYHBACBl14BAaCCBzAwggcsMIIFFKADAgECAhB74U8u0bpbgRsKLTmgHN2wMA0GCSqGSIb3DQEBCwUAMIG6MQswCQYDVQQGEwJJVDEZMBcGA1UEBwwQUG9udGUgU2FuIFBpZXRybzEYMBYGA1UECgwPQXJ1YmFQRUMgUy5wLkEuMRowGAYDVQRhDBFWQVRJVC0wMTg3OTAyMDUxNzEqMCgGA1UECwwhUXVhbGlmaWVkIFRpbWUgU3RhbXBpbmcgQXV0aG9yaXR5MS4wLAYDVQQDDCVBcnViYVBFQyBFVSBRdWFsaWZpZWQgVGltZVN0YW1wIENBIEcxMB4XDTI2MDcwOTEwMTAxNFoXDTM2MDcwNjEwMTAxNFowgZ8xCzAJBgNVBAYTAklUMRgwFgYDVQQKDA9BcnViYVBFQyBTLnAuQS4xGjAYBgNVBGEMEVZBVElULTAxODc5MDIwNTE3MSowKAYDVQQLDCFRdWFsaWZpZWQgVGltZSBTdGFtcGluZyBBdXRob3JpdHkxLjAsBgNVBAMMJUFydWJhUEVDIFRpbWUgU3RhbXBpbmcgQXV0aG9yaXR5IEVRIEEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCyIfSdGuFNGnDKmJBNojHFUidpHZLRuNciPDlNHhdgMqc9TO0gRlu1YcYLVRF7aehJe0/Nmt4Mip7d8/BjZJ+HES4aNobVxX4EZQf6oc2bnfnKidtJK+8SpDFQLm28NYuFA5TQ+N5sBtgD4JLH0Rg/8KM//a2DMIGCkmihkF2/WnUUGGyWsWr32vhKU62E7mRmAzWz9NSUQqG7fCKYvneFJFC0uNpAqw3mt3/FRi9RAe4TIf07ZAbjA50bAN7Yx6rra8JBZ/+VZHuWuE3ExKIG1O1+Je2Gxa3xfbC6zhCA4PVVJTP6dx3MlAiyReSlwySvB7urKYOP2sjIdzjGAwBZAgMBAAGjggJFMIICQTAfBgNVHSMEGDAWgBRMGv1XTZoAnnjVQpXMPBaywoNaUTCBhQYIKwYBBQUHAQEEeTB3MDsGCCsGAQUFBzAChi9odHRwOi8vY2FjZXJ0LnBlYy5pdC9jZXJ0cy9hcnViYXBlYy1laWRhc3RzYS1nMTA4BggrBgEFBQcwAYYsaHR0cDovL29jc3AwMS5wZWMuaXQvdmEvYXJ1YmFwZWMtZWlkYXN0c2EtZzEwXQYDVR0gBFYwVDAJBgcEAIvsQAEDMEcGCysGAQQBgegtAQcGMDgwNgYIKwYBBQUHAgEWKmh0dHBzOi8vd3d3LnBlYy5pdC90ZXJtaW5pLWNvbmRpemlvbmkuYXNweDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDCBrQYIKwYBBQUHAQMEgaAwgZ0wCAYGBACORgEBMAgGBgQAjkYBBDCBhgYGBACORgEFMHwwPBY2aHR0cHM6Ly93d3cucGVjLml0L3JlcG9zaXRvcnkvYXJ1YmFwZWMtcXRzYS1wZHMtaXQucGRmEwJpdDA8FjZodHRwczovL3d3dy5wZWMuaXQvcmVwb3NpdG9yeS9hcnViYXBlYy1xdHNhLXBkcy1lbi5wZGYTAmVuMEAGA1UdHwQ5MDcwNaAzoDGGL2h0dHA6Ly9jcmwwMS5wZWMuaXQvdmEvYXJ1YmFwZWMtZWlkYXN0c2EtZzEvY3JsMB0GA1UdDgQWBBRd0SUuneMVHq8xHyYQoMzC8aPa3TAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBAMGDXupvhnTd/Ivbsmjk5H6DfJSw8W8StJxHpV86bG2ThWNyHiTaj48hZ1zudUe0o6guEFgyHzXEBGHcIXHbqq8n/YEoyIxtw62G9s7FEOYLwV+urbJpWyWp3eO69+pn22I27FH4fOlvdjuIEFhtN0aGovrrT3nLLLIegmvvxNEGmc7eCP29eZfnpKIALDE1wfnxjTgSfrQjS9G3nnXFOVpTjXq77GjcyGPYXCkEfhFu/WTRB4mjm6LIyXIhgPTHfnjLbVOVDuxt76745ecOvpF4ubEWPCPETb0T45N0Z8hyGeSxqIAfBX8HJ/k1sfH62TOhh28ML8Bv00JxT7eN+Kil1PBLafRJAKJG5r0qFE2WRGYFF1fMWVE6+UGEZTQTHLascJ+FcQTS+51QZ6hmTn98etcioFAKcAmQJDldBqWwRAKnP3PR2SLb11KTdW6cY2jEjOe909pk9phW2xE2haM2YRM9R37xqoDENltWmigXsrp6UjWXco0fEdaR10HgmuPXetrQ/vBsEFfMqJAKEJVqZNc7uQvlS6EtOMBM9uiIKoARp+a6oVE5mCACedaJL8Bl+Yn8qYfkgGPg+5tiHJFbsfBp8Rl4p0Mi8tF5zUNJ27y2o6M/9uSRv0mnhGnsA3tfsOL17LIXO1/gRQ55lWW/Yp1pkiNE4JfXjj4QDDvPMYIDZTCCA2ECAQEwgc8wgboxCzAJBgNVBAYTAklUMRkwFwYDVQQHDBBQb250ZSBTYW4gUGlldHJvMRgwFgYDVQQKDA9BcnViYVBFQyBTLnAuQS4xGjAYBgNVBGEMEVZBVElULTAxODc5MDIwNTE3MSowKAYDVQQLDCFRdWFsaWZpZWQgVGltZSBTdGFtcGluZyBBdXRob3JpdHkxLjAsBgNVBAMMJUFydWJhUEVDIEVVIFF1YWxpZmllZCBUaW1lU3RhbXAgQ0EgRzECEHvhTy7RuluBGwotOaAc3bAwDQYJYIZIAWUDBAIBBQCgggFmMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQxIgQgIyIJB93v8zu+JigHAD2Px1ADSjzE+FUbm3/5PHD76+AwggEVBgsqhkiG9w0BCRACLzGCAQQwggEAMIH9MIH6BCB4MJhdWThG6ReMgXg1eYV/snqeGNHSCG1MAVU6iKLw/DCB1TCBwKSBvTCBujELMAkGA1UEBhMCSVQxGTAXBgNVBAcMEFBvbnRlIFNhbiBQaWV0cm8xGDAWBgNVBAoMD0FydWJhUEVDIFMucC5BLjEaMBgGA1UEYQwRVkFUSVQtMDE4NzkwMjA1MTcxKjAoBgNVBAsMIVF1YWxpZmllZCBUaW1lIFN0YW1waW5nIEF1dGhvcml0eTEuMCwGA1UEAwwlQXJ1YmFQRUMgRVUgUXVhbGlmaWVkIFRpbWVTdGFtcCBDQSBHMQIQe+FPLtG6W4EbCi05oBzdsDANBgkqhkiG9w0BAQEFAASCAQCqe5PJb1G7NG/fBUl+vh5mE+63jWOvTjB92e5fdbm/u5ULcGQw4YncNs6ZnzQxGSSS6QcbL5F3isa5/gnynmPJRx12zRRK3SuZ92pxlDj2Pz8n22RZtlRF9qZvn5OoUIZvi5n2IfrOAjHA58svuEAbO8zJqRI3g1tW23TWm30T5ZHHpoQOuSwOSpP6Eoh0gO1izGC905/7Q2u7DvXidimn2JfmFqgH3lKo7SmwjFLNo/YU7ZT0Uvvd06ibyHx9PaZX6adNGFOnp83UX3B+ZjMn16fWKcJjI0MxlQD7eXFz+hvwkLP3yQyxLei32T27hTz9iXnwo8IqwDnztUgxANlB",
  "how_to_verify": [
    "1. sha256 the bundle you downloaded; find that digest in records-manifest.json.",
    "2. sha256 records-manifest.json itself; it must equal manifest_sha256 below.",
    "3. base64 -d the token into token.tsr, then READ it:",
    "     openssl ts -reply -token_in -in token.tsr -text",
    "   That prints the policy OID, the hash algorithm, the message imprint and the timestamp. The",
    "   imprint must equal manifest_sha256 below. -token_in is REQUIRED: this file is a bare RFC 3161",
    "   token, not a full response, and without that flag openssl reports an ASN.1 'wrong tag' error",
    "   that looks like a corrupt file and is not.",
    "4. To check the signature cryptographically as well, you need the authority's ROOT certificate,",
    "   which we do not ship — records-manifest-tsa-cert.pem beside this file is the TSA's own signing",
    "   certificate, not a chain to a trust anchor. Passing it as -CAfile fails with 'unable to get",
    "   local issuer certificate', which is the expected result and not a fault in the token. Obtain",
    "   the root from the authority, or from the national trusted list on which a qualified EU",
    "   authority is published, then:",
    "     openssl ts -verify -token_in -in token.tsr -digest <manifest_sha256> -CAfile <that root>",
    "Steps 3 and 4 contact nobody here. The authority is outside this estate and answers for the time.",
    "CORRECTED 15 September 2026: step 3 previously gave an openssl command that cannot work against",
    "the file shipped beside it. It was never run before publication. This recipe has now been run",
    "against these exact artefacts."
  ]
}