feat(upgrade): verify the sigstore signature on checksums.txt

.github/workflows/release.yml

@@ -63,6 +63,9 @@ jobs:
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: v3.1.3 # pinned: a future cosign major must not break a tagged release mid-flight
+          # `bodek upgrade` (cmd/bodek/upgrade_sigstore.go) verifies Rekor v1
+          # hashedrekord bundles with compiled-in trust roots: confirm a new
+          # cosign still emits that bundle shape before bumping this pin.
 
       # Keyless signing: Fulcio cert bound to this workflow's OIDC identity,
       # logged in Rekor. Explicit file list (not a glob of everything) so

AGENTS.md

@@ -9,7 +9,7 @@ Keep it that way.
 
 | Path | Responsibility |
 |------|----------------|
-| `cmd/bodek` | CLI entry point: flags, lifecycle, `version` / `upgrade` subcommands, connection `diagnose`, and orphan-watchdog re-exec |
+| `cmd/bodek` | CLI entry point: flags, lifecycle, `version` / `upgrade` subcommands (Sigstore-verified `checksums.txt`, `upgrade_sigstore.go`), connection `diagnose`, and orphan-watchdog re-exec |
 | `internal/server` | Launch / attach to `odek serve`, resolve the auth token, progress-aware shutdown with escalation countdown |
 | `internal/client` | odek serve WebSocket protocol (transport + REST + decoding) |
 | `internal/tokens` | Local persistence of per-session auth tokens |

README.md

@@ -78,7 +78,13 @@ curl -fsSL https://bodek.21no.de/install.sh | sh
 You still need a provider API key for the engine (`DEEPSEEK_API_KEY` /
 `ZAI_API_KEY` — see odek's [PROVIDERS.md](https://github.com/BackendStack21/odek/blob/main/docs/PROVIDERS.md)
 and its [install instructions](https://github.com/BackendStack21/odek)).
-Later, `bodek upgrade` downloads and installs the latest release the same way.
+Later, `bodek upgrade` downloads and installs the latest release: it verifies
+the release's `checksums.txt` against its Sigstore signature (the release
+workflow's keyless certificate for that exact tag, logged in Rekor), then the
+archive against `checksums.txt` (SHA-256), and refuses to install on any failure.
+The signature pins the tag being installed, not freshness: a compromised release
+feed can still offer an older genuine release that is newer than the installed
+one (a `dev` build accepts whichever signed release the feed names).
 
 On Windows, download the `windows_amd64` (or `arm64`) `.zip` from the
 [releases page](https://github.com/BackendStack21/bodek/releases) and put
@@ -121,7 +127,8 @@ bodek --plain                                     # linear mode: transcript to s
 bodek --reduce-motion                             # calmer transcript: clock lane at 2s, no accent pulses
 bodek -- --prompt-caching                         # pass extra flags through to `odek serve`
 bodek version                                     # print the bodek version
-bodek upgrade                                     # download and install the latest release
+bodek upgrade                                     # download and install the latest release (Sigstore + SHA-256 verified)
+bodek upgrade --skip-signature                    # UNSAFE: checksum-only, when the embedded Sigstore root is stale
 ```
 
 `odek serve` protects its WebSocket and REST APIs with a per-instance token it
@@ -695,6 +702,14 @@ never become the weakest link:
 - **`bodek upgrade` returns 403** — GitHub's anonymous API quota (or an IP
   block) rejected the request. Retry, or set `GITHUB_TOKEN` / `GH_TOKEN`
   (`gh auth token`). bodek also falls back to the HTML latest-release page.
+- **`bodek upgrade` reports `signature verification failed`** — the release's
+  `checksums.txt.bundle` did not verify for that tag, so nothing was installed.
+  The Sigstore trust root is compiled in: after a Sigstore root or Rekor key
+  rotation an older bodek cannot verify newer releases. Verify the release
+  yourself (`cosign verify-blob --bundle checksums.txt.bundle
+  --certificate-identity https://github.com/BackendStack21/bodek/.github/workflows/release.yml@refs/tags/<tag>
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt`)
+  and then run `bodek upgrade --skip-signature`, or reinstall with the install script.
 - **Auth errors when attaching** — copy the *full* token URL `odek serve`
   printed (`--url 'http://…/?token=…'`) or pass the token via `--token`.
   Spawned instances adopt the token automatically.

cmd/bodek/main.go

@@ -146,7 +146,7 @@ func parseConfig(args []string, output io.Writer) (config, error) {
 		_, _ = fmt.Fprintf(fs.Output(), "A terminal interface for the odek agent.\n\n")
 		_, _ = fmt.Fprintf(fs.Output(), "Commands:\n")
 		_, _ = fmt.Fprintf(fs.Output(), "  version   print the bodek version\n")
-		_, _ = fmt.Fprintf(fs.Output(), "  upgrade   download and install the latest release\n\n")
+		_, _ = fmt.Fprintf(fs.Output(), "  upgrade   download, verify (Sigstore + SHA-256), and install the latest release\n\n")
 		_, _ = fmt.Fprintf(fs.Output(), "Options:\n")
 		fs.PrintDefaults()
 		_, _ = fmt.Fprintf(fs.Output(), "\nExamples:\n")

cmd/bodek/testdata/upgrade/checksums.txt

@@ -0,0 +1,6 @@
+a8cc31ea23f6e5e8b1771bfb756fd8364aa372ef9500893f78509cd3bd9a3014  bodek_1.20.3_darwin_amd64.tar.gz
+d7d72a901dfea51b8d4b599bf8361203809cf962a3016dd9550dda4094141635  bodek_1.20.3_darwin_arm64.tar.gz
+6e56ac4e9bfaf546cf5d13301e145f9e9a32efb3c5816ab6a653675e8ce6c456  bodek_1.20.3_linux_amd64.tar.gz
+ab99105f719cca0a3d0e9ea9019ad1c1aa4ad0ecb7cf71596430349320ab4bb7  bodek_1.20.3_linux_arm64.tar.gz
+dd1d2f52b0dd7e291c22a53a2da460ce1d7caf67826eb0ce6ae3b94d877824f1  bodek_1.20.3_windows_amd64.zip
+ad747b14da26f30236e7f8511d25f859954ceaa7c38541c4945547b27e3aa2d5  bodek_1.20.3_windows_arm64.zip

cmd/bodek/testdata/upgrade/checksums.txt.bundle

@@ -0,0 +1 @@
+{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIG6zCCBnCgAwIBAgIULdkKwP5D7+wCNqn+MsqxVQjcghAwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMDE3MTUyMjIwWhcNMjYxMDE3MTUzMjIwWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUU5FWMEQW9hJ3CMldXYfhrqyP3CGhrlLzpOQJj+KJVm1gXuMuYeGnah9FZ18lztemI+VnFCVMIUPpK+I+XJvhaOCBY8wggWLMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBTf0+nPViQRlvmo2OkoVaLGLhhkPzBlBgNVHREBAf8EWzBZhldodHRwczovL2dpdGh1Yi5jb20vQmFja2VuZFN0YWNrMjEvYm9kZWsvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy90YWdzL3YxLjIwLjMwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKGRiNWZkZTZkYTliNWNkMTRiM2UwMmViYTYwYTBjMzE1YThmZWEyYzMwFQYKKwYBBAGDvzABBAQHUmVsZWFzZTAiBgorBgEEAYO/MAEFBBRCYWNrZW5kU3RhY2syMS9ib2RlazAfBgorBgEEAYO/MAEGBBFyZWZzL3RhZ3MvdjEuMjAuMzA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wZwYKKwYBBAGDvzABCQRZDFdodHRwczovL2dpdGh1Yi5jb20vQmFja2VuZFN0YWNrMjEvYm9kZWsvLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWxAcmVmcy90YWdzL3YxLjIwLjMwOAYKKwYBBAGDvzABCgQqDChkYjVmZGU2ZGE5YjVjZDE0YjNlMDJlYmE2MGEwYzMxNWE4ZmVhMmMzMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA3BgorBgEEAYO/MAEMBCkMJ2h0dHBzOi8vZ2l0aHViLmNvbS9CYWNrZW5kU3RhY2syMS9ib2RlazA4BgorBgEEAYO/MAENBCoMKGRiNWZkZTZkYTliNWNkMTRiM2UwMmViYTYwYTBjMzE1YThmZWEyYzMwIQYKKwYBBAGDvzABDgQTDBFyZWZzL3RhZ3MvdjEuMjAuMzAaBgorBgEEAYO/MAEPBAwMCjEyNzMwNzQzMTIwMQYKKwYBBAGDvzABEAQjDCFodHRwczovL2dpdGh1Yi5jb20vQmFja2VuZFN0YWNrMjEwGAYKKwYBBAGDvzABEQQKDAg4MzI4MjUzNDBnBgorBgEEAYO/MAESBFkMV2h0dHBzOi8vZ2l0aHViLmNvbS9CYWNrZW5kU3RhY2syMS9ib2Rlay8uZ2l0aHViL3dvcmtmbG93cy9yZWxlYXNlLnltbEByZWZzL3RhZ3MvdjEuMjAuMzA4BgorBgEEAYO/MAETBCoMKGRiNWZkZTZkYTliNWNkMTRiM2UwMmViYTYwYTBjMzE1YThmZWEyYzMwFAYKKwYBBAGDvzABFAQGDARwdXNoMFsGCisGAQQBg78wARUETQxLaHR0cHM6Ly9naXRodWIuY29tL0JhY2tlbmRTdGFjazIxL2JvZGVrL2FjdGlvbnMvcnVucy8zOTA0NDYwNjU4NC9hdHRlbXB0cy8xMBYGCisGAQQBg78wARYECAwGcHVibGljMD8GCisGAQQBg78wARgEMQwvcmVwbzpCYWNrZW5kU3RhY2syMS9ib2RlazpyZWY6cmVmcy90YWdzL3YxLjIwLjMwgYsGCisGAQQB1nkCBAIEfQR7AHkAdwDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAaFKdPIDAAAEAwBIMEYCIQDl2t4KcgA+btWtifJfyvuKYvJnr0y8NgzVgIxIvqq3VgIhAMRX0BCG6KOrdzOacCLoBDK6feFNgBGM+mSUf7cb5RrdMAoGCCqGSM49BAMDA2kAMGYCMQD1MmIzMSFEDQs61UQ5Q+SL7t08q6GqEgThHTXYpl0LHS9TVCQXZ9jlINpQl5X0HsMCMQDFzYG/aDMIPOgp0j9rVsU0sLnjQHG7GgGCvmEecidSjv1tpLbi2ef/wvIBEpZG0To="},"tlogEntries":[{"logIndex":"3296821189","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"hashedrekord","version":"0.0.1"},"integratedTime":"1792250544","inclusionPromise":{"signedEntryTimestamp":"MEUCIHB/ymQb8m6bkO0Qpq8IwKtPvBWZFhrbttNBZeACUadXAiEAvToQlzUd9VC3T4xIgxp9DYtzVF7PgTtOfB/cBKAizmg="},"inclusionProof":{"logIndex":"3174916927","rootHash":"bhLfac0+/wbMA9GzKS2trYiDb4lpMJXA0ZmZAi2Onpo=","treeSize":"3174917761","hashes":["zgmzii06yUMfq2BG1Jl8eudqUQYWpE560yc614Nx9v4=","+01QcnggYtEVAf2aQSyfd0CaSvY5KJzoW2yVtlNFHaE=","56gtTh0pu/qJ9U23YB/G3aJgpSF9UV6YKqYZOSR0dsQ=","cpZB8ldW96Gtz9inHOASm/+tBGtZDwRCgR5fqXbK9pI=","Y+I03m2TJTXK2SFCgiWuUOmkt1bDDai+uc5s2wDsLGo=","8o7owqzZvsk8cTOv3UnTnW0ub9ldREF6bIylhQgVv+I=","SQyrl3rQatWkIgqguySPdzWfcU9ebWbzrWCbGD6E6Hw=","PephACmttpODOaBycormR2rofDQIpEAQDWBp/LcQyso=","bFGwxe6xDQzKRA8krUXhR8oqBhM7nhT3axFy/5EiP5g=","XbVKXFlnuA48i1XYCcESlUHB8/+2mLjYbUi1/9+ruD4=","uYS77LZbd2yZZoUHa2TxXnGhq4SpxsL9aLj2g4MEcdw=","C+mbNVnJA9lp6jZ6jfWurcCm5lpWRhggr7WtC4xmu0g=","of7VDk9Rnywks69HL6/srx5VEOaW8cw13hj9hp+2sO0=","xGYZHO/a6DRN82mJW5k4bhKfDsF+LjzILilI50QHCKo=","FXATjdRtireOoENXvnccda3kWZrIMfOFPFr+cZNyVy8=","ahwEIoN0sDCApbC3oYJD9OLJ0wp0a+vc41wzB4/JGUU=","QcgNaWbDGFYkOXAurnhhi3DU8mkXcxbK1BRso2hhgB0=","ikoMXchfJZJN2lVXlFWJe+I+YhbglVO39nk+PNBe2fE=","w7OdPlzy7mnrtLvUv3uPMoFUxXZBeBfz4KnXmNezpOo=","qlTWNDzERnTBQVcHHXXVPjiUP0SsikGxfcxVlgqVFDo=","gg9GNApNke3+zNhl4tsWtmIycCFrOMCB3lys6XuSQNQ=","NlOclldmKPA1tMKIskqHAwuQDYHp31YwpK+OOMrMccc=","qxzHanAzz57SDdmJe0B7bJK72NTIBbwEMGBBKvDOROw=","xH/DCseLHr9eKoYT8qsORZK7zVdEGYWHuVtsVrD95wY="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n3174917761\nbhLfac0+/wbMA9GzKS2trYiDb4lpMJXA0ZmZAi2Onpo=\n\n— rekor.sigstore.dev wNI9ajBFAiEAiK2E78IznhRYfo4Mp11ZNphn/bhwDLSjpbVMBpZSrUQCIB6fiLTeOl5U66Bq0kdcH+Lvl8VT/d6gqhoydCd23TyN\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI1NzVjNTUzOTRmMWRiZTcwNzdlNzkwODFhMDFjZTM0NjYwMTExYzZiMjI2YmQ1NzEzZjM0OTIzNWFhYTgzNTgxIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJR0E3NEJFM3YzNUZVRldFcUg5Z243VFg3ZnFJYi9mRTZ3NUk3WS9uU0NNYkFpRUEzNWdQeXZwcjhIOFhCaTdKVXd0OWNpbmdhaHlFeTQrN1RBY3RpNzhGQ1VNPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVYzJla05EUW01RFowRjNTVUpCWjBsVlRHUnJTM2RRTlVRM0szZERUbkZ1SzAxemNYaFdVV3BqWjJoQmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFplRTFFUlROTlZGVjVUV3BKZDFkb1kwNU5hbGw0VFVSRk0wMVVWWHBOYWtsM1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZWVlRWR1YwMUZVVmM1YUVvelEwMXNaRmhaWm1oeWNYbFFNME5IYUhKc1RIcHdUMUVLU21vclMwcFdiVEZuV0hWTmRWbGxSMjVoYURsR1dqRTRiSHAwWlcxSksxWnVSa05XVFVsVlVIQkxLMGtyV0VwMmFHRlBRMEpaT0hkbloxZE1UVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXWkNaMDVXU0ZOTlJVZEVRVmRuUWxSbUNqQXJibEJXYVZGU2JIWnRiekpQYTI5V1lVeEhUR2hvYTFCNlFteENaMDVXU0ZKRlFrRm1PRVZYZWtKYWFHeGtiMlJJVW5kamVtOTJUREprY0dSSGFERUtXV2sxYW1JeU1IWlJiVVpxWVRKV2RWcEdUakJaVjA1eVRXcEZkbGx0T1d0YVYzTjJURzFrY0dSSGFERlphVGt6WWpOS2NscHRlSFprTTAxMlkyMVdjd3BhVjBaNldsTTFOV0pYZUVGamJWWnRZM2s1TUZsWFpIcE1NMWw0VEdwSmQweHFUWGRQVVZsTFMzZFpRa0pCUjBSMmVrRkNRVkZSY21GSVVqQmpTRTAyQ2t4NU9UQmlNblJzWW1rMWFGa3pVbkJpTWpWNlRHMWtjR1JIYURGWmJsWjZXbGhLYW1JeU5UQmFWelV3VEcxT2RtSlVRVk5DWjI5eVFtZEZSVUZaVHk4S1RVRkZRMEpCVW5ka1dFNXZUVVJaUjBOcGMwZEJVVkZDWnpjNGQwRlJUVVZMUjFKcFRsZGFhMXBVV210WlZHeHBUbGRPYTAxVVVtbE5NbFYzVFcxV2FRcFpWRmwzV1ZSQ2FrMTZSVEZaVkdodFdsZEZlVmw2VFhkR1VWbExTM2RaUWtKQlIwUjJla0ZDUWtGUlNGVnRWbk5hVjBaNldsUkJhVUpuYjNKQ1owVkZDa0ZaVHk5TlFVVkdRa0pTUTFsWFRuSmFWelZyVlROU2FGa3ljM2xOVXpscFlqSlNiR0Y2UVdaQ1oyOXlRbWRGUlVGWlR5OU5RVVZIUWtKR2VWcFhXbm9LVEROU2FGb3pUWFprYWtWMVRXcEJkVTE2UVRkQ1oyOXlRbWRGUlVGWlR5OU5RVVZKUWtNd1RVc3lhREJrU0VKNlQyazRkbVJIT1hKYVZ6UjFXVmRPTUFwaFZ6bDFZM2sxYm1GWVVtOWtWMG94WXpKV2VWa3lPWFZrUjFaMVpFTTFhbUl5TUhkYWQxbExTM2RaUWtKQlIwUjJla0ZDUTFGU1drUkdaRzlrU0ZKM0NtTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJVVzFHYW1FeVZuVmFSazR3V1ZkT2NrMXFSWFpaYlRscldsZHpka3h0WkhCa1IyZ3hXV2s1TTJJelNuSUtXbTE0ZG1RelRYWmpiVlp6V2xkR2VscFROVFZpVjNoQlkyMVdiV041T1RCWlYyUjZURE5aZUV4cVNYZE1hazEzVDBGWlMwdDNXVUpDUVVkRWRucEJRZ3BEWjFGeFJFTm9hMWxxVm0xYVIxVXlXa2RGTlZscVZtcGFSRVV3V1dwT2JFMUVTbXhaYlVVeVRVZEZkMWw2VFhoT1YwVTBXbTFXYUUxdFRYcE5RakJIQ2tOcGMwZEJVVkZDWnpjNGQwRlJjMFZFZDNkT1dqSnNNR0ZJVm1sTVYyaDJZek5TYkZwRVFUTkNaMjl5UW1kRlJVRlpUeTlOUVVWTlFrTnJUVW95YURBS1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxEV1ZkT2NscFhOV3RWTTFKb1dUSnplVTFUT1dsaU1sSnNZWHBCTkVKbmIzSkNaMFZGUVZsUEx3cE5RVVZPUWtOdlRVdEhVbWxPVjFwcldsUmFhMWxVYkdsT1YwNXJUVlJTYVUweVZYZE5iVlpwV1ZSWmQxbFVRbXBOZWtVeFdWUm9iVnBYUlhsWmVrMTNDa2xSV1V0TGQxbENRa0ZIUkhaNlFVSkVaMUZVUkVKR2VWcFhXbnBNTTFKb1dqTk5kbVJxUlhWTmFrRjFUWHBCWVVKbmIzSkNaMFZGUVZsUEwwMUJSVkFLUWtGM1RVTnFSWGxPZWsxM1RucFJlazFVU1hkTlVWbExTM2RaUWtKQlIwUjJla0ZDUlVGUmFrUkRSbTlrU0ZKM1kzcHZka3d5WkhCa1IyZ3hXV2sxYWdwaU1qQjJVVzFHYW1FeVZuVmFSazR3V1ZkT2NrMXFSWGRIUVZsTFMzZFpRa0pCUjBSMmVrRkNSVkZSUzBSQlp6Uk5la2swVFdwVmVrNUVRbTVDWjI5eUNrSm5SVVZCV1U4dlRVRkZVMEpHYTAxV01tZ3daRWhDZWs5cE9IWmFNbXd3WVVoV2FVeHRUblppVXpsRFdWZE9jbHBYTld0Vk0xSm9XVEp6ZVUxVE9Xa0tZakpTYkdGNU9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNMk41T1hsYVYzaHNXVmhPYkV4dWJIUmlSVUo1V2xkYWVrd3pVbWhhTTAxMlpHcEZkUXBOYWtGMVRYcEJORUpuYjNKQ1owVkZRVmxQTDAxQlJWUkNRMjlOUzBkU2FVNVhXbXRhVkZwcldWUnNhVTVYVG10TlZGSnBUVEpWZDAxdFZtbFpWRmwzQ2xsVVFtcE5la1V4V1ZSb2JWcFhSWGxaZWsxM1JrRlpTMHQzV1VKQ1FVZEVkbnBCUWtaQlVVZEVRVkozWkZoT2IwMUdjMGREYVhOSFFWRlJRbWMzT0hjS1FWSlZSVlJSZUV4aFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTUVwb1dUSjBiR0p0VWxSa1IwWnFZWHBKZUV3eVNuWmFSMVp5VERKR2FncGtSMngyWW01TmRtTnVWblZqZVRoNlQxUkJNRTVFV1hkT2FsVTBUa001YUdSSVVteGlXRUl3WTNrNGVFMUNXVWREYVhOSFFWRlJRbWMzT0hkQlVsbEZDa05CZDBkalNGWnBZa2RzYWsxRU9FZERhWE5IUVZGUlFtYzNPSGRCVW1kRlRWRjNkbU50Vm5kaWVuQkRXVmRPY2xwWE5XdFZNMUpvV1RKemVVMVRPV2tLWWpKU2JHRjZjSGxhVjFrMlkyMVdiV041T1RCWlYyUjZURE5aZUV4cVNYZE1hazEzWjFselIwTnBjMGRCVVZGQ01XNXJRMEpCU1VWbVVWSTNRVWhyUVFwa2QwUmtVRlJDY1hoelkxSk5iVTFhU0doNVdscDZZME52YTNCbGRVNDBPSEptSzBocGJrdEJUSGx1ZFdwblFVRkJZVVpMWkZCSlJFRkJRVVZCZDBKSkNrMUZXVU5KVVVSc01uUTBTMk5uUVN0aWRGZDBhV1pLWm5sMmRVdFpka3B1Y2pCNU9FNW5lbFpuU1hoSmRuRnhNMVpuU1doQlRWSllNRUpEUnpaTFQzSUtaSHBQWVdORFRHOUNSRXMyWm1WR1RtZENSMDByYlZOVlpqZGpZalZTY21STlFXOUhRME54UjFOTk5EbENRVTFFUVRKclFVMUhXVU5OVVVReFRXMUplZ3BOVTBaRlJGRnpOakZWVVRWUksxTk1OM1F3T0hFMlIzRkZaMVJvU0ZSWVdYQnNNRXhJVXpsVVZrTlJXRm81YW14SlRuQlJiRFZZTUVoelRVTk5VVVJHQ25wWlJ5OWhSRTFKVUU5bmNEQnFPWEpXYzFVd2MweHVhbEZJUnpkSFowZERkbTFGWldOcFpGTnFkakYwY0V4aWFUSmxaaTkzZGtsQ1JYQmFSekJVYnowS0xTMHRMUzFGVGtRZ1EwVlNWRWxHU1VOQlZFVXRMUzB0TFFvPSJ9fX19"}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICyTADAgEAMIICwAYJKoZIhvcNAQcCoIICsTCCAq0CAQMxDTALBglghkgBZQMEAgEwgbgGCyqGSIb3DQEJEAEEoIGoBIGlMIGiAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgWNaB12s7abjFy+c0//R1R/01z6soi0IdzwwUVpmLCSwCFQCh8Q56sRPO4Z6wcEq3Ap3lJL5F2BgPMjAyNjEwMTcxNTIyMjBaMAMCAQGgMqQwMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhoAAxggHaMIIB1gIBATBRMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQCFDoTVC8MkGHuvMFDL8uKjosqI4sMMAsGCWCGSAFlAwQCAaCB/DAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTAxNzE1MjIyMFowLwYJKoZIhvcNAQkEMSIEIFyLLTcql4vA/BV/VyeIFLBhLoRVI1MkCRVpyBl/4PN1MIGOBgsqhkiG9w0BCRACLzF/MH0wezB5BCCF+Se8B6tiysO0Q1bBDvyBssaIP9p6uebYcNnROs0FtzBVMD2kOzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDAKBggqhkjOPQQDAgRmMGQCMGL6UOUfPZ0pzFUmB1h/8Xf2JJu7XzS3ynI2bo1QsOJYLzdU7Eh05Yi0ALNmGr+1owIwC3EgNhN+XCLCmz3rF+AqndTKrP4VZIWf57clw8qmcuX3nZMupy9jAvZ3htJMsXz3"}]}},"messageSignature":{"messageDigest":{"algorithm":"SHA2_256","digest":"V1xVOU8dvnB355CBoBzjRmARHGsia9VxPzSSNaqoNYE="},"signature":"MEUCIGA74BE3v35FUFWEqH9gn7TX7fqIb/fE6w5I7Y/nSCMbAiEA35gPyvpr8H8XBi7JUwt9cingahyEy4+7TActi78FCUM="}}