# True Witness Here — FreeTSA + POPCORN checkpoint Two native signed attestations bind to the same exact **385-byte checkpoint file**. The checkpoint was witnessed on October 14, 2026; this verification package was prepared October 16, 2026 (Pacific). ## Run both verifications Extract the ZIP into a writable folder. Install Node.js 20 or newer and OpenSSL 3.x, then run from the extracted folder: ```sh node verify.mjs ``` The checker makes no network requests and no payments. It reads the original evidence without altering it. It writes fresh `verification.json` and `verification.log` results beside the script, replacing the included results when rerun. A passing run exits with status 0 and reports `"status": "PASS"` with 12 passing checks. OpenSSL must be available as `openssl`, or set the `OPENSSL` environment variable to its executable path. On Windows, the checker also recognizes Git for Windows' OpenSSL at `C:/Program Files/Git/usr/bin/openssl.exe`. ```powershell $env:OPENSSL = 'C:/Program Files/Git/usr/bin/openssl.exe' node verify.mjs ``` ## Exact underlying commands The log contains the commands and their output from the published run: ```sh openssl version openssl ts -verify -data checkpoint.txt -in checkpoint.tsr -CAfile freetsa-cacert.pem -untrusted freetsa-tsa.crt openssl ts -reply -in checkpoint.tsr -text ``` The timestamp verification returned `Verification: OK`. To inspect the file digest separately: ```sh openssl dgst -sha256 checkpoint.txt ``` The expected SHA-256 is: ```text 03eecd1ed8866d816e183834fbf7f94543ecca18d0a1adc0f3b798252e6058a2 ``` For POPCORN, `verify.mjs` uses Node's `crypto.verify` with SHA-256, the published P-256 key, and the 64-byte IEEE-P1363 signature. It verifies the exact ASCII JWS signing input (`encodedHeader.encodedPayload`), requires ES256 and the expected key ID, checks the separately pinned key thumbprint, compares the complete outer `witness_receipt` to the signed JSON payload, and compares the signed payload digest to the file's SHA-256. The script also checks the stated interval and evidence scope. ## Files and results | File | Purpose | | --- | --- | | `checkpoint.txt` | Original 385-byte checkpoint. Preserve its exact bytes and line endings. | | `checkpoint.tsr` | Original 4,643-byte RFC 3161 timestamp response. | | `popcorn-receipt.json` | Original 7,019-byte full POPCORN response, including its ES256 compact JWS. | | `freetsa-cacert.pem` | FreeTSA root certificate, obtained separately from its official HTTPS site. | | `freetsa-tsa.crt` | FreeTSA TSA certificate, obtained separately from its official HTTPS site. | | `popcorn-keys.json` | Public POPCORN key set, obtained separately from its issuer HTTPS endpoint. | | `verify.mjs` | Portable offline checker with recorded trust fingerprints. | | `verification.json` | Published verification results, input hashes and stated trust scope. | | `verification.log` | Published OpenSSL commands and output. | | `operator-working.txt` | Operator's published working, as supplied by Violet. | | `SHA256SUMS.txt` | Package file hashes, for checking byte consistency. | | Check | Published result | | --- | --- | | FreeTSA signature, certificate chain and checkpoint imprint | Pass, trusting the recorded FreeTSA root | | POPCORN ES256 signature and exact checkpoint digest binding | Pass, trusting the recorded POPCORN witness key | | Outer POPCORN witness receipt matches the signed JSON payload | Pass | | Both signed digests match the exact checkpoint file | Pass | | FreeTSA time | 2026-10-14T23:24:34Z | | FreeTSA accuracy field | Unspecified | | POPCORN witness time | 2026-10-14T23:26:25.273Z | | POPCORN asserted time interval | 23:26:15.273Z through 23:26:35.273Z | The stated times are **111.273 seconds apart**. These are two separate witness events, not a measurement of clock disagreement. ## Sources and trust - FreeTSA's documented certificate locations: - Root: - TSA certificate: - POPCORN keys: - Operator's working: - Public receipt view: Certificates and public keys were retrieved on October 16, 2026 (Pacific), separately from the receipt. The checker's trust starts with those issuer HTTPS endpoints and the fingerprints pinned in the script: - FreeTSA root certificate SHA-256 over DER bytes: `a6379e7cecc05faa3cbf076013d745e327bbbaa38c0b9af22469d4701d18aabc`. - POPCORN `popcorn-witness-2026-01` RFC 7638 JWK SHA-256 thumbprint, base64url: `ns4g75U5Bsn2bA3XtaSuQhDg065PVkhYgs3KOtJVPf0`. The package does not independently establish historical key ownership. A reader must decide whether to trust the stated sources and fingerprints; a package cannot establish that trust merely by including its own keys and checker. Certificate validity is evaluated by OpenSSL at the time of a rerun, so a future run can fail if certificates have expired. ## Exact scope The result establishes two valid signatures binding the same file digest under the stated keys. Busindre's independent confirmation on October 15 covered the FreeTSA timestamp/checkpoint match. It did not cover the POPCORN signature; that signature is checked by the portable script in this package. FreeTSA's accuracy field is unspecified. No policy-supplied clock bound was verified. Strict-deadline reasoning from the FreeTSA side therefore remains indeterminate in this package. POPCORN's ±10-second interval is issuer-asserted, not an independently measured UTC error bound. The checks do not validate the truth of the checkpoint's contents, prove action execution, grant authorization, or establish delivery. No certificate revocation checks or original `.tsq` request nonce comparison were performed. The package does not independently validate payment settlement, nonce freshness, or clock accuracy.