Anyone holding a Trace evidence ZIP can re-check it without trusting us. One Python script recomputes the file hashes, walks the custody chain and checks each timestamp token against the file it stamps. It prints a pass/fail table.
Script: trace_verify.py (single file, Python 3.10 or newer, standard library plus one small ASN.1 library for the timestamp checks). The same file ships inside every evidence ZIP, so the copy you were given and the copy here should be identical. Compare their SHA-256 if that matters to you.
It checks integrity and dates. It does not, and cannot, check attribution. Read what a pass shows before relying on it.
MANIFEST.sha256 covers the archive bytes.python3 trace_verify.py case_<id>.zip
The hash and custody checks need nothing beyond Python. The timestamp checks need one extra
library; if it is missing the script says which one and how to install it, and marks those
rows as skipped rather than failing them. Run python3 trace_verify.py --help
for the options. The exit code is non-zero when any check fails.
| Check | What passes | What a fail means |
|---|---|---|
| Manifest hashes | Every file listed in MANIFEST.sha256 hashes to the listed value. |
A file was changed, replaced or truncated after the pack was built. |
| Pack consistency | The leaked-file and delivered-copy hashes quoted in SUMMARY.md,
chain_of_custody.md and evidence_pack.json agree. |
The documents do not describe the same files. |
| Custody chain | Each row in custody_log carries the hash of the previous row, from the
first step to the export step. |
A step was inserted, removed or edited. |
| Timestamps (RFC 3161) | Each timestamps/*.tsr token's message imprint equals the SHA-256 of the
file named in timestamps/index.json; the script prints the TSA, the time
in the token and whether the pack records the TSA as qualified. |
The token does not belong to that file, or the file changed after stamping. |
The script does not validate the TSA's certificate chain or check revocation. That needs the
TSA's CA certificates and a tool such as OpenSSL (openssl ts -verify); the index
file names the TSA and its policy OID so a reviewer can do that step.
SUMMARY.md, with its stated limits.
When no timestamp tokens are present the pack says so plainly in SUMMARY.md
("no external timestamp obtained"). The hashes are then self-attested by Trace; the
verifier still confirms the files have not changed since the ZIP was built, but the dates
rest on Trace's clock alone.
identification_routes.md lists procedural options by
country; it is an outline for counsel, not advice.How the pack itself is produced, from collection to reporting, is described in the robustness report.
Trace puts an invisible, per-fan mark in each copy you deliver. If a copy leaks, Trace says which delivered copy it matches, and gives you a pack like the one this page describes.