Demo bundle verification

Download all files listed in manifest.json, plus manifest.json.sig and signer.pub. Keep the directory structure. Import this synthetic demo key into a separate keystore:

  pipelock trust sample-agent signer.pub --keystore ./demo-trust

Verify the manifest signature:

  pipelock verify manifest.json --agent sample-agent --keystore ./demo-trust

For assessment and summary bundles, also verify artifact hashes:

  pipelock assess verify . --agent sample-agent --keystore ./demo-trust

This verifies sample integrity against the supplied demo key. It does not authenticate an operator or prove execution.