Verify on your
auditor's machine.

curl -sLo export.json https://usehasp.com/trust/audit-export-sample.json
curl -sLo published-keys.json https://usehasp.com/.well-known/audit-keys.json

diff <(jq -r '.verification.public_key_pem' export.json) \
     <(jq -r '.keys[0].public_key_pem' published-keys.json) \
  && echo "key match: OK"

# macOS (coreutils provides sha256sum; macOS ships shasum instead by default)
brew install jq openssl@3 coreutils
python3 -m pip install --user cryptography

# Debian / Ubuntu
sudo apt-get install jq openssl coreutils python3-pip
python3 -m pip install --user cryptography

import json, hashlib

with open("export.json") as f:
    data = json.load(f)

def canon(v):
    # Recursively sort object keys; arrays keep their order; scalars unchanged.
    if isinstance(v, dict):
        return {k: canon(v[k]) for k in sorted(v)}
    if isinstance(v, list):
        return [canon(x) for x in v]
    return v

prev = None
for e in data["entries"]:
    assert e["prev_hash"] == prev, f"prev_hash mismatch at seq={e['seq']}"
    row = [
        e["user_id"], e["org_id"], e["project_id"], e["action"],
        e["entity_type"], e["entity_id"], canon(e["metadata"]),
        e["ip_address"], e["created_at"], e["phi_disposition"],
        e["subject_type"], e["subject_id_hmac"],
    ]
    if e.get("asserted_actor_hmac") is not None or e.get("customer_id") is not None:
        row.append(e.get("asserted_actor_hmac"))
    if e.get("customer_id") is not None:
        row.append(e["customer_id"])
    payload = json.dumps(row, separators=(",", ":"), ensure_ascii=False)
    h = hashlib.sha256(payload.encode()).hexdigest()
    assert h == e["hash"], f"chain broken at seq={e['seq']}"
    prev = e["hash"]

assert prev == data["verification"]["chain_head_hash"], "chain head mismatch"
print(f"chain intact, {len(data['entries'])} entries verified")

import json, base64
from cryptography.hazmat.primitives.serialization import load_pem_public_key

with open("export.json") as f:
    data = json.load(f)

pub = load_pem_public_key(data["verification"]["public_key_pem"].encode())
ok = 0
for e in data["entries"]:
    sig = base64.b64decode(e["signature"].split(":", 1)[1])
    # The signed message is the hex hash STRING, not its decoded bytes.
    pub.verify(sig, e["hash"].encode())
    ok += 1

print(f"signatures verified: {ok}")

BASE=$(jq -r '.verification.fold_base // empty' export.json)
[ -n "$BASE" ] || BASE=$(printf '0%.0s' {1..64})

jq -c '.verification.tsa_anchor_chain[]' export.json | while read -r ANCHOR; do
  ALGO=$(jq -r '.algo // "row-hash-v1"' <<< "$ANCHOR")
  DATA=$(jq -r '.anchored_data' <<< "$ANCHOR")
  CHECKPOINT=$(jq -r '.checkpoint_after_entry' <<< "$ANCHOR")

  if [ "$ALGO" = "sha256-fold-v2" ]; then
    ENTRY_ID=$(jq -r '.anchored_entry_id' <<< "$ANCHOR")
    STATE="$BASE"
    FOUND=0
    while IFS=$'\t' read -r ID HASH; do
      STATE=$(printf '%s%s' "$STATE" "$HASH" | sha256sum | cut -d' ' -f1)
      [ "$ID" = "$ENTRY_ID" ] && { FOUND=1; break; }
    done < <(jq -r '.entries[] | [.id, .hash] | @tsv' export.json)
    if [ "$FOUND" = "1" ] && [ "$STATE" = "$DATA" ]; then
      echo "anchor at entry $CHECKPOINT: chain prefix confirmed (v2)"
    else
      echo "anchor at entry $CHECKPOINT: FAILED to bind — stop, this is a finding"
    fi
  else
    if jq -e --arg h "$DATA" '.entries[] | select(.hash == $h)' export.json > /dev/null; then
      echo "anchor at entry $CHECKPOINT: single entry confirmed (v1)"
    else
      echo "anchor at entry $CHECKPOINT: FAILED to bind — stop, this is a finding"
    fi
  fi
done

jq -c '.verification.tsa_anchor_chain[]' export.json | while read -r ANCHOR; do
  DATA=$(jq -r '.anchored_data' <<< "$ANCHOR")
  CHECKPOINT=$(jq -r '.checkpoint_after_entry' <<< "$ANCHOR")

  jq -r '.tsa_tsr_base64' <<< "$ANCHOR" | base64 -d > "anchor-$CHECKPOINT.tsr"
  curl -sSLo "tsa-cert-$CHECKPOINT.pem" "$(jq -r '.tsa_cacert_url' <<< "$ANCHOR")"

  echo "-- anchor at entry $CHECKPOINT --"
  openssl ts -verify -in "anchor-$CHECKPOINT.tsr" -CAfile "tsa-cert-$CHECKPOINT.pem" -digest "$DATA"
done

RESET=$(jq -r '.verification.lineage_reset_at // empty' export.json)
if [ -n "$RESET" ]; then
  echo "WARNING: chain lineage was reset at $RESET — this export covers only history after that point"
else
  echo "no lineage reset — the chain is intact from its start"
fi

VARIANT=$(jq -r '.variant // empty' export.json)
[ "$VARIANT" = "customer_segment" ] || { echo "not a customer-scoped export"; exit 0; }

BASE=$(jq -r '.verification.segment_fold_base // empty' export.json)
[ -n "$BASE" ] || BASE=$(printf '0%.0s' {1..64})

jq -c '.verification.segment_anchor_chain[]' export.json | while read -r ANCHOR; do
  ENTRY_ID=$(jq -r '.anchored_entry_id' <<< "$ANCHOR")
  FOLD=$(jq -r '.fold_state' <<< "$ANCHOR")
  ROOT=$(jq -r '.merkle_root' <<< "$ANCHOR")

  # 1) Recompute the segment fold through the anchored entry.
  STATE="$BASE"; FOUND=0
  while IFS=$'\t' read -r ID HASH; do
    STATE=$(printf '%s%s' "$STATE" "$HASH" | sha256sum | cut -d' ' -f1)
    [ "$ID" = "$ENTRY_ID" ] && { FOUND=1; break; }
  done < <(jq -r '.entries[] | [.id, .hash] | @tsv' export.json)
  [ "$FOUND" = "1" ] && [ "$STATE" = "$FOLD" ] || { echo "FAILED: fold does not bind"; continue; }

  # 2) Hash up the inclusion path to the batch root the token certifies.
  NODE="$FOLD"
  while IFS=$'\t' read -r POS SIB; do
    if [ "$POS" = "left" ]; then PAIR="$SIB$NODE"; else PAIR="$NODE$SIB"; fi
    NODE=$(printf '%s' "$PAIR" | sha256sum | cut -d' ' -f1)
  done < <(jq -r '.merkle_path[] | [.position, .hash] | @tsv' <<< "$ANCHOR")

  if [ "$NODE" = "$ROOT" ]; then
    echo "segment anchor binds: fold + inclusion path confirmed (verify the token over $ROOT)"
  else
    echo "FAILED: inclusion path does not reach merkle_root — stop, this is a finding"
  fi
done