936c81c388472c8b4d1a476ac126ef09f1b088cee13d93aa1cb3deea894130cb
A COSE_Sign1 statement issued by Tyche Institute MTÜ over a Cryptographic Bill of Materials we did not write. Everything needed to check it yourself is on this page.
What it does not establish, and there is no receipt here.
This statement has not been submitted to any transparency service and appears in no log. A receipt requires a service to submit to and a log to be included in; there is no honest way to produce one locally, and a fabricated one would be exactly the failure this work exists to prevent. Selecting that service is an open item of the PKI Consortium CBOM Profiles Working Group as of its meeting of 19 August 2026.
It also says nothing about whether the issuer is accredited or trusted by anyone, and nothing about whether the CBOM's contents are correct.
There is no verify button and no verify endpoint on this site, deliberately. A server that answers valid is a claim you have to trust. Download the five files into one directory and run:
python3 verify.py
Expected output ends VERIFIED OFFLINE, exit code 0. Needs cbor2 and
cryptography; needs no network.
| File | Bytes | What it is |
|---|---|---|
| signed-statement.cose | 1675 | the statement, payload attached |
| signed-statement-detached.cose | 131 | same signature, payload omitted |
| subject-cbom.json | 1542 | the CBOM that was signed |
| issuer-public-key.pem | 178 | the issuer's public key |
| verify.py | 2157 | independent offline verifier |
| manifest.json | — | the same facts, machine-readable |
The subject is taken unmodified from the official CycloneDX examples repository. Choosing a document we had no hand in is the point: it is what demonstrates that the authenticity layer does not care which profile or base format the document uses.