Evidence
The perito package
What a notification's evidence package (.zip) contains and how a perito verifies it without access to Notificado.
Updated:
The evidence package is a .zip that a perito (expert witness), a judge or the other party verifies with standard tools and no access to Notificado. Download it from the notification, under Notifications, together with the constancia PDF. Every download is recorded.
What it contains
| File | What it is |
|---|---|
manifest.json |
Every file with its SHA-256 and size; the timestamps and what each covers. |
SHA256SUMS |
The same hashes, for sha256sum -c. |
mensaje/*.eml |
The exact message sent to each recipient. |
adjuntos/ |
The documents, byte for byte. |
eventos/eventos.json |
Chained events (previous hash + hash), daily anchors and Merkle proofs. |
eventos/raw/ |
What the providers answered, as received. |
sellos/*.tsr |
The RFC 3161 timestamp tokens. |
sellos/tsa-ca/*.pem |
Each timestamp authority's root of trust. |
constancia.pdf |
The signed constancia. |
firma/cert-chain.pem |
The chain of trust of the constancia's signature. |
verificar.js |
Automatic verifier. |
LEEME.txt / README.txt |
Instructions in Spanish and in English. |
Automatic verification
With Bun, openssl, sha256sum and pdfsig (poppler-utils) installed, inside the unzipped folder:
bun verificar.jsExit 0 = verified; 1 = something does not verify (it is named); 2 = unreadable package; 3 = openssl missing.
Manual verification
sha256sum -c SHA256SUMS
openssl ts -reply -in sellos/<stamp>.tsr -text
openssl ts -verify -data mensaje/<recipient>.eml -in sellos/<stamp>.tsr -CAfile sellos/tsa-ca/<authority>.pem
pdfsig constancia.pdfEach timestamp must answer Verification: OK. In the chain, every event satisfies hash = sha256(previous_hash followed by the event in RFC 8785 canonical JSON): altering, removing or reordering one event breaks every event after it.
What it does not prove
That a person read the message: openings are indicios. Nor who clicked a download link — only when, from which IP and with which browser. The judge decides whether the notification is valid.