# Verify before execution

This candidate is **unsigned** until the owner signs it. Its manifest and test
report are available for review. Neither one establishes the publisher's
identity by itself.

Choose the verification path specified by the handoff:

- Signed publication: authenticate the manifest with the owner's signature as
  described below, then verify the full inventory before executing package code.
- Explicitly authorized unsigned review: obtain the expected manifest digest
  through the review handoff. Run the inventory check below and compare its
  printed manifest digest exactly before executing package code. This branch
  does not require an owner signature and does not authenticate a publisher.
  If a ZIP is supplied, also obtain its expected digest through the handoff and
  check it with `shasum -a 256` before extraction. If only an extracted directory
  is supplied, no ZIP digest is required; do not search for an absent archive.

For a signed publication, use an already trusted Minisign installation. Obtain
the expected public key through an independently authenticated Eziah channel.
A key shipped only inside the same untrusted download is not an independent
trust anchor. Keep the signature and public key outside the frozen directory.

For signed publication, verify the exact MANIFEST.json before running any
package script. The explicitly authorized unsigned-review branch skips only
this signature step; it still requires the manifest-pin and inventory checks:

```bash
minisign -Vm "/absolute/path/EZA-001-R001-rc.9/MANIFEST.json" -x "/absolute/path/MANIFEST.json.minisig" -p "/absolute/path/eziah-release.pub"
```

Check every manifest-listed artifact using this standard-library command in
a trusted Python installation. For signed publication, run it only after the
signature command succeeds. For explicitly authorized unsigned review, compare
the printed manifest digest with the handoff before any package execution.
This command reads files; it does not import or execute package code.
Replace the path with your extracted release directory.

```bash
python3 -I -B - "/absolute/path/EZA-001-R001-rc.9" <<'PYVERIFY'
import hashlib, json, pathlib, stat, sys
root = pathlib.Path(sys.argv[1]).resolve()
manifest = root / "MANIFEST.json"
assert not manifest.is_symlink()
raw = manifest.read_bytes()
data = json.loads(raw)
seen = {"MANIFEST.json"}
for row in data["files"]:
    assert set(row) == {"path", "bytes", "sha256"}
    name = row["path"]
    part = pathlib.PurePosixPath(name)
    assert not part.is_absolute() and ".." not in part.parts
    assert str(part) == name and "\\" not in name and name not in seen
    path = root / name
    assert not any(p.is_symlink() for p in [path, *path.parents])
    assert stat.S_ISREG(path.lstat().st_mode)
    value = path.read_bytes()
    assert len(value) == row["bytes"]
    assert hashlib.sha256(value).hexdigest() == row["sha256"]
    seen.add(name)
actual = set()
for path in root.rglob("*"):
    assert not path.is_symlink()
    assert path.is_file() or path.is_dir()
    if path.is_file(): actual.add(path.relative_to(root).as_posix())
assert actual == seen
print("VERIFIED INVENTORY", len(seen), "files")
print("MANIFEST SHA-256", hashlib.sha256(raw).hexdigest())
PYVERIFY
```

In the signed-publication path, the trusted signature authenticates the manifest.
In the unsigned-review path, a matching handoff pin identifies only the supplied
bytes. The inventory check binds the manifest to every listed file in both paths.
Keep the directory protected from modification between verification and execution.
Then use the verified manifest digest with the reproduction command. A changed
artifact, extra file, mismatched required digest, or failed required signature
blocks execution. Do not regenerate the manifest to silence a mismatch.
Unsigned review does not satisfy the public signature gate.

The owner signing procedure is in SIGNING.md. A signature never activates
code, issues a grant, migrates a release, or makes the candidate production
ready.