SHA-256 / provenance / local-only
Checksum delivery receipt
Record checksum equality separately from whether the reference value has trusted provenance. Data stays on this device.
Fixed fixture
artifact-v1|web-tool|2026-09-23
| Check | Value | Meaning |
|---|---|---|
| Computed hash | Not calculated | Compare with the reference |
| Reference hash | 4dcb3bded66e8aef… | The reference value itself |
| Provenance | Unknown | Verify signature or official source separately |
Boundary
- Compare the computed hash with the reference value.
- Verify provenance using a separate piece of evidence.
- Do not treat unknown as matched or safe.
- Keep this separate from upload or external sending.
A matching hash does not prove that the reference source or distributor is trustworthy.