CFI.co Transparency Archive - Verification Attestation
======================================================

Repository:       github.com/cfi-co/articles
As of (UTC):      2026-07-22
Commit:           b8ff09a7a2fbf33b01eb60ebd0524aecd32d1f94
Release tag:      archive-2026-07-schema-2.4
Schema version:   2.4
Records:          2779 (2011-2026)
sha256(MANIFEST.sha256) = 1324220999f98918dd17688767c2823ac6cdc6634cc436385d40d12f71efe27c
Signing key:      CFI.co Transparency Archive <archive@cfi.co>
                  fpr B497BDC19FCD487972D5D2B0876FF2AA39133BF8

Statement
  As of the commit above, scripts/verify.sh passes: every record's
  content_sha256 equals SHA-256 of its verbatim content_html, every
  record_sha256 equals the recorded recipe hash, and MANIFEST.sha256
  lists the SHA-256 of every tracked file. This attestation fixes the
  SHA-256 of that manifest. The signed release archive-2026-07-schema-2.4
  additionally GPG-signs a manifest of its distribution assets.

Verify this attestation
  gpg --import SIGNING-KEY.asc            # from the repository root
  gpg --verify attestation-articles-2026-07-22.txt.asc attestation-articles-2026-07-22.txt

Verify the archive
  git clone https://github.com/cfi-co/articles.git
  cd articles && ./scripts/verify.sh
  sha256sum MANIFEST.sha256      # must equal the value above