Evidence Dossier and receipt example

Synthetic worked example

Detect manifest and payload tampering

What if a file and its listed digest are both edited?

The outer package digest binds the manifest, so coordinated edits still fail unless the package identity also changes.

Starting inputs

A verified synthetic package

One changed payload byte

An edited file digest

The original package digest

Ordered execution

Work the example

  1. 1

    Recompute the changed file digest.

  2. 2

    Compare it with the edited manifest entry.

  3. 3

    Recompute the package digest over the edited manifest.

  4. 4

    Compare it with the immutable package identity.

  5. 5

    Refuse the package when the outer digest differs.

Expected outputs

  • File-level match after coordinated edit
  • Package-level mismatch
  • A tamper refusal rather than a repaired package

Verification checks

  • The outer digest covers manifest entries.
  • A one-byte mutation changes package identity.
  • Prior package bytes remain recoverable.

Fail closed

Refusal conditions

  • The manifest is allowed to self-authorize.
  • The package digest is rewritten in place.
  • The altered package retains the old identity.

Digest-bound public fixture

Check the expected state

This fixture contains synthetic operational fields only. Its digest establishes fixture integrity, not scientific truth or a completed commercial transaction.

{
  "artifactKind": "dossier-package",
  "schemaVersion": "maha-evidence-dossier/0.1",
  "input": {
    "mutation": "one-byte-payload-change",
    "manifestDigestAlsoEdited": true
  },
  "expected": {
    "fileDigestCheck": "pass",
    "packageDigestCheck": "refuse"
  },
  "artifactSha256": "sha256:ef86118533acb7944fde73b1036f999f5b7c3262f8e21c7efe6179f2d558fad1"
}