Pemarks Verifier

Verify extract reports outside Pemarks.

Pemarks ships a Python verifier that checks the integrity of an extract report against the original-resources archive, validates the embedded TSA timestamps, and optionally correlates browser netlog timestamps against the archival window. Use it when you need an external validation workflow, an audit trail, or a reproducible review package.

What it validates Extract report structure, ignition and validation TSAs, content-subtree hash, original resource hashes, and optional netlog timing boundaries.
What you need The extract report XML, the original-resources archive ZIP or its extracted tree, and optionally the netlog JSON captured for the same archive.
Where it lives Download it from this page, or find it in packaged distributions under utils/python/validate_extract_report.py.

1. Expected workspace

The script assumes you run it in a folder that already contains the downloaded evidence bundle for one archive, or that you pass that folder path explicitly. The expected files are:

  • The extract report XML.
  • The original-resources archive ZIP, or the extracted archive tree if you already unzipped it.
  • The netlog JSON if you want timestamp-window correlation.
my-review-folder/
  extract-report.xml
  pemarks-original-resources-example.zip
  capture.netlog.json   # optional

2. Typical commands

If your shell is already in the evidence folder, run the verifier without arguments. Otherwise pass the folder path, or explicitly point to the report, archive, or netlog when you need to override auto-detection.

Download the verifier script 
# run from the evidence folder
python3 utils/python/validate_extract_report.py

# run against another folder
python3 utils/python/validate_extract_report.py /path/to/my-review-folder

# explicit file selection
python3 utils/python/validate_extract_report.py \
  /path/to/my-review-folder \
  --extract-report /path/to/my-review-folder/extract-report.xml \
  --archive /path/to/my-review-folder/pemarks-original-resources-example.zip \
  --netlog /path/to/my-review-folder/capture.netlog.json

3. Validation sequence

The verifier checks the extract report XML first: root structure, ignition block, content subtree, validation block, and required attributes.

It then validates the ignition TSA. This confirms the start-of-archive timestamp against the original target URL payload.

Next it rebuilds and hashes the serialized <content> subtree, compares that hash with the report, and validates the validation TSA token.

After that it checks every Page and Resource OriginalHash against the original-resources archive contents.

If a netlog is present, it looks for matching browser-fetched timestamps and verifies that they fall between the ignition TSA time and the validation TSA time.

4. How to read the output

The verifier writes line-by-line status messages. [OK] means the check passed. [INFO] is contextual output, such as skipping netlog validation when no netlog was supplied. [ERROR] means the validation failed or a required input could not be resolved.

Exit code 0 means the full verification completed without errors. Exit code 1 means at least one validation failed or the verifier could not start correctly.

5. Operational notes

  • The script supports either the ZIP archive directly or the extracted folder tree.
  • Resources absent from the netlog are not treated as failures. Pemarks may have fetched them itself during processing rather than through the browser.
  • The TSA verification path uses openssl. Make sure it is available on the machine running the verifier.
  • The verifier is intended for post-download review. It does not contact the Pemarks server.
Open the User Guide Read the proof chapter