{
  "schema": "https://sigilsec.ai/attestation/verify/v1",
  "issuer": "NOMARK Pty Ltd",
  "product": "Sigil",
  "description": "Public keys and verification instructions for Sigil scan attestations. Attestation signing is not yet active: the Sigil Bot signing key below has status 'pending' and no public key is published. When the keypair is generated, the key will be populated and Sigil Bot scans will be signed with it (Ed25519, DSSE envelope, in-toto Statement v1) with optional Rekor transparency log submission. Until then, scan results cannot be independently verified against this document.",
  "keys": [
    {
      "keyId": "sha256:sigil-bot-signing-key-2026",
      "algorithm": "Ed25519",
      "publicKey": null,
      "encoding": "base64-der",
      "validFrom": "2026-03-01T00:00:00Z",
      "validUntil": null,
      "status": "pending",
      "_note": "Public key will be populated when the Sigil Bot signing keypair is generated. Status will change to 'active' at that point."
    }
  ],
  "predicateType": "https://sigilsec.ai/attestation/scan/v1",
  "attestationSpec": "https://in-toto.io/Statement/v1",
  "envelopeSpec": "https://github.com/secure-systems-lab/dsse",
  "transparencyLog": {
    "uri": "https://rekor.sigstore.dev",
    "type": "rekor"
  },
  "verification": {
    "steps": [
      "Fetch the scan attestation from /api/v1/attestation/{scan_id} (404 when the scan has no attestation)",
      "Decode the DSSE envelope payload (base64url to JSON)",
      "Verify the in-toto Statement _type is 'https://in-toto.io/Statement/v1'",
      "Verify the predicateType is 'https://sigilsec.ai/attestation/scan/v1'",
      "Verify the subject digest matches the package archive SHA-256 from the registry",
      "Verify the DSSE signature against the published public key using Ed25519 (not possible while the key status is 'pending')",
      "Optionally verify the transparency log entry at the log_uri + log_entry_id"
    ],
    "endpoints": {
      "attestation": "https://sigilsec.ai/api/v1/attestation/{scan_id}",
      "verify": "https://sigilsec.ai/api/v1/verify?scan_id={scan_id}",
      "feed": "https://sigilsec.ai/api/v1/feed"
    },
    "_note": "No verification SDK or `sigil verify` CLI command ships today. Verify with a standard DSSE/Ed25519 library following the steps above."
  },
  "lastUpdated": "2026-09-03T00:00:00Z"
}