VERIFICATION
Verify it yourself
Don't trust, verify.
USDseal signatures are reproducible. Every signed USDZ carries SHA-256 hashes per ZIP component — you can recompute them independently in 5 lines of Python. Inspector shows the same hashes live in the browser, the Independent Verifier handles the full manifest roundtrip.
3-Layer Trust Architecture
Layer 1 — Component Hash
SHA-256 per ZIP member. If a single byte changes, the hash changes. Inspector shows every component.
Layer 2 — Pre-Seal Hash
Hash of the entire USDZ before manifest injection. Specified in Spec v1.0, implementation in progress in the sealing code.
Layer 3 — Manifest Signature
COSE_Sign1 / Ed25519. Independent Verifier script implemented, Inspector live-verify coming in v0.3.
Verify yourself — 5 lines of Python:
import zipfile, hashlib
z = zipfile.ZipFile('signed.usdz')
for member in z.namelist():
h = hashlib.sha256(z.read(member)).hexdigest()
print(member, h)
→ Inspector shows the same hashes live in the browser.
→ Independent Verifier (Python, ~120 lines) handles the full manifest roundtrip — github.com/KopfKinoK3/usdseal-verify.