{
  "status": "PASS",
  "verified_at_utc": "2026-10-17T05:49:47.859Z",
  "node": "v24.11.1",
  "inputs": {
    "checkpoint.txt": {
      "bytes": 385,
      "sha256": "03eecd1ed8866d816e183834fbf7f94543ecca18d0a1adc0f3b798252e6058a2"
    },
    "checkpoint.tsr": {
      "bytes": 4643,
      "sha256": "d4213e71c60a1a23bdd0cade0f57288ef3fb096848127c6a6e779a26d0f8ea8c"
    },
    "popcorn-receipt.json": {
      "bytes": 7019,
      "sha256": "c6fa69b9fc11a905ac344ee0cabf5b20a20b9151f5f33a1cae58cb5b6ae03045"
    },
    "popcorn-keys.json": {
      "bytes": 418,
      "sha256": "936957f453f6a5fabe93a9748ee68603be51bff521ddfd0ad6599fed336ce554"
    },
    "freetsa-cacert.pem": {
      "bytes": 2833,
      "sha256": "2151b61137ffa86bf664691ba67e7da0b19f98c758e3d228d5d8ebf27e044438"
    },
    "freetsa-tsa.crt": {
      "bytes": 2273,
      "sha256": "8bfb0305bb64e2571ca507552ef3245cb1c2fee8728e0ff8689225081ea13467"
    }
  },
  "trust": {
    "pinned_freetsa_root_certificate_sha256": "a6379e7cecc05faa3cbf076013d745e327bbbaa38c0b9af22469d4701d18aabc",
    "pinned_popcorn_rfc7638_jwk_thumbprint_sha256_base64url": "ns4g75U5Bsn2bA3XtaSuQhDg065PVkhYgs3KOtJVPf0",
    "key_material_source": "Separately fetched issuer HTTPS endpoints. Trust starts at these endpoints and the fingerprints pinned in verify.mjs.",
    "source_urls": {
      "freetsa_root": "https://freetsa.org/files/cacert.pem",
      "freetsa_tsa": "https://freetsa.org/files/tsa.crt",
      "popcorn_keys": "https://767-2676.com/.well-known/popcorn-keys.json"
    },
    "retrieval_date_pacific": "2026-10-16",
    "scope": "Signature validity and exact checkpoint digest binding under these pinned keys. Independent historical key ownership, clock accuracy, revocation status, identity, execution, authorization, delivery, payment settlement and nonce freshness are not established by this check.",
    "freetsa_accuracy_scope": "The RFC 3161 token accuracy is unspecified. No policy-supplied clock bound was verified. No revocation checks or original .tsq nonce comparison were performed."
  },
  "checks": [
    {
      "name": "Exact checkpoint SHA-256 matches the recorded October 14 checkpoint",
      "status": "PASS"
    },
    {
      "name": "FreeTSA root certificate matches the separately recorded DER fingerprint",
      "status": "PASS"
    },
    {
      "name": "FreeTSA RFC 3161 signature, certificate chain, timestamp purpose and data binding",
      "status": "PASS"
    },
    {
      "name": "FreeTSA timestamp is granted, SHA-256, and has the same checkpoint imprint",
      "status": "PASS"
    },
    {
      "name": "POPCORN JWS uses the expected ES256 algorithm, key id and type",
      "status": "PASS"
    },
    {
      "name": "POPCORN verification key matches the separately recorded RFC 7638 thumbprint",
      "status": "PASS"
    },
    {
      "name": "POPCORN compact JWS cryptographic signature verifies over its exact encoded bytes",
      "status": "PASS"
    },
    {
      "name": "Full outer witness_receipt exactly equals the signed JWS payload as JSON values",
      "status": "PASS"
    },
    {
      "name": "Signed POPCORN commitment binds the exact same checkpoint SHA-256",
      "status": "PASS"
    },
    {
      "name": "Signed POPCORN time and asserted interval are internally consistent",
      "status": "PASS"
    },
    {
      "name": "Signed POPCORN scope remains a digest commitment, without extra proof claims",
      "status": "PASS"
    },
    {
      "name": "Verification did not change any input bytes",
      "status": "PASS"
    }
  ],
  "openssl": "OpenSSL 3.5.4 30 Sep 2025 (Library: OpenSSL 3.5.4 30 Sep 2025)",
  "freetsa_root": {
    "subject": "O=Free TSA\nOU=Root CA\nCN=www.freetsa.org\nemailAddress=busilezas@gmail.com\nL=Wuerzburg\nST=Bayern\nC=DE",
    "issuer": "O=Free TSA\nOU=Root CA\nCN=www.freetsa.org\nemailAddress=busilezas@gmail.com\nL=Wuerzburg\nST=Bayern\nC=DE",
    "valid_from": "Mar 13 01:52:13 2016 GMT",
    "valid_to": "Mar  7 01:52:13 2041 GMT",
    "certificate_sha256": "a6379e7cecc05faa3cbf076013d745e327bbbaa38c0b9af22469d4701d18aabc"
  },
  "freetsa": {
    "status": "granted",
    "message_imprint_sha256": "03eecd1ed8866d816e183834fbf7f94543ecca18d0a1adc0f3b798252e6058a2",
    "serial": "0x09313363",
    "timestamp_utc": "2026-10-14T23:24:34.000Z",
    "nonce": "0x98E10CA1C32F1042",
    "accuracy": "unspecified"
  },
  "popcorn": {
    "algorithm": "ES256",
    "key_id": "popcorn-witness-2026-01",
    "jwk_thumbprint": "ns4g75U5Bsn2bA3XtaSuQhDg065PVkhYgs3KOtJVPf0",
    "receipt_id": "pwr_eb7e440aaff765e9d803c42d96c171c6",
    "tain": "tain_01M4YBT3FSPW08EWE0MGPN2WCT",
    "message_imprint_sha256": "03eecd1ed8866d816e183834fbf7f94543ecca18d0a1adc0f3b798252e6058a2",
    "witnessed_at_utc": "2026-10-14T23:26:25.273Z",
    "clock_accuracy_radius_ms": 10000,
    "witness_window_utc": {
      "earliest": "2026-10-14T23:26:15.273Z",
      "latest": "2026-10-14T23:26:35.273Z"
    },
    "clock_accuracy_independently_verified": false,
    "scope": {
      "type": "payload_commitment_witness",
      "payload_disclosed": false,
      "caller_identity_proven": false,
      "recipient_delivery_proven": false,
      "action_execution_proven": false,
      "nonce_uniqueness_enforced": false,
      "replay_prevented": false,
      "authorization_granted": false,
      "external_atomic_clock_alignment_proven": false,
      "clock_accuracy_independently_verified": false,
      "payer_authorization_bound_to_commitment": false
    }
  },
  "displayed_timestamp_difference_seconds": 111.273
}