HOW TO VERIFY THIS ZIP
DEMO · Simulated project. Client, agency, people outside Cherry Blossom Lab, dates and seals are fictional. File fingerprints (SHA-256) are real.

1. File fingerprints (works in this demo, the hashes are real)
   macOS / Linux:   shasum -a 256 -c MANIFEST_SHA256.txt
   Windows:         Get-FileHash "01_FINAL_DELIVERY\<file>" -Algorithm SHA256
   Every line must match. One changed byte changes the fingerprint.

2. C2PA Content Credentials (real projects)
   Open any file of 01_FINAL_DELIVERY at https://contentcredentials.org/verify

3. Trusted timestamps RFC 3161 (real projects)
   openssl ts -verify -in <token>.tsr -data <file> -CAfile <tsa-ca>.pem

4. OpenTimestamps / Bitcoin (real projects)
   ots verify <file>.ots

5. Certification code
   Re-issue the report from Partners. If the code 27C2-4F84-3104-FB33 matches, nothing was altered.
