Verify on your
auditor's machine.

curl -sLo export.json https://usehasp.com/trust/audit-export-sample.json
curl -sLo published-keys.json https://usehasp.com/.well-known/audit-keys.json
# For your own org's export instead of the sample, fetch published-keys.json
# from the /trust/keys/{org} endpoint under your platform account instead.

TENANT_ID=$(jq -r '.export.tenant_id' export.json)
KEY_ID=$(jq -r '.verification.key_id' export.json)

[ "$(jq -r '.tenant_id' published-keys.json)" = "$TENANT_ID" ] || {
  echo "published key document is for the wrong tenant — stop"; exit 1;
}

diff <(jq -r '.verification.public_key_pem' export.json) \
     <(jq -r --arg kid "$KEY_ID" '.keys[] | select(.key_id == $kid) | .public_key_pem' published-keys.json) \
  && echo "key match: OK"

# macOS (coreutils provides sha256sum; macOS ships shasum instead by default)
brew install jq openssl@3 coreutils
python3 -m pip install --user cryptography

# Debian / Ubuntu
sudo apt-get install jq openssl coreutils python3-pip
python3 -m pip install --user cryptography

import json, hashlib

with open("export.json") as f:
    data = json.load(f)

def canon(v):
    # Recursively sort object keys; arrays keep their order; scalars unchanged.
    if isinstance(v, dict):
        return {k: canon(v[k]) for k in sorted(v)}
    if isinstance(v, list):
        return [canon(x) for x in v]
    return v

prev = None
for e in data["entries"]:
    assert e["prev_hash"] == prev, f"prev_hash mismatch at seq={e['seq']}"
    row = [
        e["user_id"], e["org_id"], e["project_id"], e["action"],
        e["entity_type"], e["entity_id"], canon(e["metadata"]),
        e["ip_address"], e["created_at"], e["phi_disposition"],
        e["subject_type"], e["subject_id_hmac"],
    ]
    asserted = e.get("asserted_actor_hmac")
    customer = e.get("customer_id")
    caller_attribution = e.get("caller_attribution")
    user_agent = e.get("user_agent")
    if asserted is not None or customer is not None or caller_attribution is not None or user_agent is not None:
        row.append(asserted)
    if customer is not None or caller_attribution is not None or user_agent is not None:
        row.append(customer)
    if caller_attribution is not None or user_agent is not None:
        row.append(canon(caller_attribution))
    if user_agent is not None:
        row.append(user_agent)
    payload = json.dumps(row, separators=(",", ":"), ensure_ascii=False)
    h = hashlib.sha256(payload.encode()).hexdigest()
    assert h == e["hash"], f"chain broken at seq={e['seq']}"
    prev = e["hash"]

assert prev == data["verification"]["chain_head_hash"], "chain head mismatch"
print(f"chain intact, {len(data['entries'])} entries verified")

import json, base64
from cryptography.hazmat.primitives.serialization import load_pem_public_key

with open("export.json") as f:
    data = json.load(f)

# Build the key_id -> public key map. Single-key exports have no "keys"
# array; treat that as one key under its own key_id.
keys = data["verification"].get("keys") or [
    {"key_id": data["verification"]["key_id"], "public_key_pem": data["verification"]["public_key_pem"]}
]
pubkeys = {k["key_id"]: load_pem_public_key(k["public_key_pem"].encode()) for k in keys}

ok = 0
for e in data["entries"]:
    key_id = e.get("key_id", data["verification"].get("key_id"))
    assert key_id in pubkeys, f"entry seq={e['seq']} references unpublished key_id {key_id}"
    sig = base64.b64decode(e["signature"].split(":", 1)[1])
    # The signed message is the hex hash STRING, not its decoded bytes.
    pubkeys[key_id].verify(sig, e["hash"].encode())
    ok += 1

print(f"signatures verified: {ok}")

BASE=$(jq -r '.verification.fold_base // empty' export.json)
[ -n "$BASE" ] || BASE=$(printf '0%.0s' {1..64})

jq -c '.verification.tsa_anchor_chain[]' export.json | while read -r ANCHOR; do
  ALGO=$(jq -r '.algo // "row-hash-v1"' <<< "$ANCHOR")
  DATA=$(jq -r '.anchored_data' <<< "$ANCHOR")
  CHECKPOINT=$(jq -r '.checkpoint_after_entry' <<< "$ANCHOR")

  if [ "$ALGO" = "sha256-fold-v2" ]; then
    ENTRY_ID=$(jq -r '.anchored_entry_id' <<< "$ANCHOR")
    STATE="$BASE"
    FOUND=0
    while IFS=$'\t' read -r ID HASH; do
      STATE=$(printf '%s%s' "$STATE" "$HASH" | sha256sum | cut -d' ' -f1)
      [ "$ID" = "$ENTRY_ID" ] && { FOUND=1; break; }
    done < <(jq -r '.entries[] | [.id, .hash] | @tsv' export.json)
    if [ "$FOUND" = "1" ] && [ "$STATE" = "$DATA" ]; then
      echo "anchor at entry $CHECKPOINT: chain prefix confirmed (v2)"
    else
      echo "anchor at entry $CHECKPOINT: FAILED to bind — stop, this is a finding"
    fi
  else
    if jq -e --arg h "$DATA" '.entries[] | select(.hash == $h)' export.json > /dev/null; then
      echo "anchor at entry $CHECKPOINT: single entry confirmed (v1)"
    else
      echo "anchor at entry $CHECKPOINT: FAILED to bind — stop, this is a finding"
    fi
  fi
done

jq -c '.verification.tsa_anchor_chain[]' export.json | while read -r ANCHOR; do
  DATA=$(jq -r '.anchored_data' <<< "$ANCHOR")
  CHECKPOINT=$(jq -r '.checkpoint_after_entry' <<< "$ANCHOR")

  jq -r '.tsa_tsr_base64' <<< "$ANCHOR" | base64 -d > "anchor-$CHECKPOINT.tsr"
  curl -sSLo "tsa-cert-$CHECKPOINT.pem" "$(jq -r '.tsa_cacert_url' <<< "$ANCHOR")"

  echo "-- anchor at entry $CHECKPOINT --"
  openssl ts -verify -in "anchor-$CHECKPOINT.tsr" -CAfile "tsa-cert-$CHECKPOINT.pem" -digest "$DATA"
done

KEY_ID=$(jq -r '.verification.key_id' export.json)
STATUS=$(jq -r --arg kid "$KEY_ID" '.keys[] | select(.key_id == $kid) | .status' published-keys.json)

if [ "$STATUS" != "revoked" ]; then
  echo "signing key status: $STATUS — nothing further to check"
  exit 0
fi

REVOKED_AT=$(jq -r --arg kid "$KEY_ID" '.keys[] | select(.key_id == $kid) | .revoked_at' published-keys.json)
REVOKED_EPOCH=$(date -u -d "$REVOKED_AT" +%s 2>/dev/null || date -u -jf "%Y-%m-%dT%H:%M:%S%z" "$REVOKED_AT" +%s)

# GEN_TIME is the "Time stamp:" line openssl printed in the previous step,
# for whichever anchor covers the entry you're checking.
GEN_EPOCH=$(date -u -d "$GEN_TIME" +%s 2>/dev/null || date -u -jf "%b %e %T %Y %Z" "$GEN_TIME" +%s)

if [ "$GEN_EPOCH" -lt "$REVOKED_EPOCH" ]; then
  echo "signature predates the revocation ($GEN_TIME < $REVOKED_AT) — proceed, but note it in your findings"
else
  echo "signature does not provably predate the revocation — this is a failure, stop"
fi

RESET=$(jq -r '.verification.lineage_reset_at // empty' export.json)
if [ -n "$RESET" ]; then
  echo "WARNING: chain lineage was reset at $RESET — this export covers only history after that point"
else
  echo "no lineage reset — the chain is intact from its start"
fi

VARIANT=$(jq -r '.variant // empty' export.json)
[ "$VARIANT" = "customer_segment" ] || { echo "not a customer-scoped export"; exit 0; }

BASE=$(jq -r '.verification.segment_fold_base // empty' export.json)
[ -n "$BASE" ] || BASE=$(printf '0%.0s' {1..64})

jq -c '.verification.segment_anchor_chain[]' export.json | while read -r ANCHOR; do
  ENTRY_ID=$(jq -r '.anchored_entry_id' <<< "$ANCHOR")
  FOLD=$(jq -r '.fold_state' <<< "$ANCHOR")
  ROOT=$(jq -r '.merkle_root' <<< "$ANCHOR")

  # 1) Recompute the segment fold through the anchored entry.
  STATE="$BASE"; FOUND=0
  while IFS=$'\t' read -r ID HASH; do
    STATE=$(printf '%s%s' "$STATE" "$HASH" | sha256sum | cut -d' ' -f1)
    [ "$ID" = "$ENTRY_ID" ] && { FOUND=1; break; }
  done < <(jq -r '.entries[] | [.id, .hash] | @tsv' export.json)
  [ "$FOUND" = "1" ] && [ "$STATE" = "$FOLD" ] || { echo "FAILED: fold does not bind"; continue; }

  # 2) Hash up the inclusion path to the batch root the token certifies.
  NODE="$FOLD"
  while IFS=$'\t' read -r POS SIB; do
    if [ "$POS" = "left" ]; then PAIR="$SIB$NODE"; else PAIR="$NODE$SIB"; fi
    NODE=$(printf '%s' "$PAIR" | sha256sum | cut -d' ' -f1)
  done < <(jq -r '.merkle_path[] | [.position, .hash] | @tsv' <<< "$ANCHOR")

  if [ "$NODE" = "$ROOT" ]; then
    echo "segment anchor binds: fold + inclusion path confirmed (verify the token over $ROOT)"
  else
    echo "FAILED: inclusion path does not reach merkle_root — stop, this is a finding"
  fi
done