CFI.co Transparency Archive - Verification Attestation
======================================================

Repository:       github.com/cfi-co/awards
As of (UTC):      2026-07-22
Commit:           060ca687c07f45b87a06a2698c7285ad736a97ca
Release tag:      archive-2026-07-schema-2.4
Schema version:   2.4
Records:          2377 (2012-2026)
sha256(MANIFEST.sha256) = 98ad5ec76b57c26daab827d97807dd42e3e4e4c06d43389d6d30099b5dd65b2d
Signing key:      CFI.co Transparency Archive <archive@cfi.co>
                  fpr B497BDC19FCD487972D5D2B0876FF2AA39133BF8

Statement
  As of the commit above, scripts/verify.sh passes: every record's
  content_sha256 equals SHA-256 of its verbatim content_html, every
  record_sha256 equals the recorded recipe hash, and MANIFEST.sha256
  lists the SHA-256 of every tracked file. This attestation fixes the
  SHA-256 of that manifest. The signed release archive-2026-07-schema-2.4
  additionally GPG-signs a manifest of its distribution assets.

Verify this attestation
  gpg --import SIGNING-KEY.asc            # from the repository root
  gpg --verify attestation-awards-2026-07-22.txt.asc attestation-awards-2026-07-22.txt

Verify the archive
  git clone https://github.com/cfi-co/awards.git
  cd awards && ./scripts/verify.sh
  sha256sum MANIFEST.sha256      # must equal the value above