Skip to main content

Evidence Bundle Export

Export the signed audit chain for a Jira project as a self-contained ZIP bundle that can be verified offline — no internet connection, no Attestsys account required.

What the bundle contains​

Each export bundle is a ZIP archive containing:

FileContents
manifest.jsonBundle metadata: tenant ID, export timestamp, entry count, chain head hash
entries/One JSON file per audit chain entry, containing the signed payload, ECDSA signature (DER-encoded), RFC 3161 timestamp token (DER-encoded), and chain linkage hashes
public-keys/The ECDSA public key(s) used to sign entries in this bundle, in PEM format
tsa-certs/The certificate chain(s) of the RFC 3161 timestamp authority (TSA) that issued the timestamp tokens
cover.pdfA human-readable PDF cover page listing the bundle metadata, entry count, verification summary, and a verification notice
verify.htmlA self-contained offline verifier — open in any browser to verify every signature and chain link without any server calls

Downloading a bundle​

The project Admin page — the Evidence bundle export section with the Download Evidence Bundle button and the signed-and-bundled export status

Bundles are downloaded from the Admin page of the Forge app. Click Download Evidence Bundle to generate and download the current chain. The admin page shows how many exports have been used in the current calendar month.

On the free tier, the maximum is 10 bundle exports per calendar month (UTC, aligned with the Atlassian Marketplace billing cycle). A counter on the admin page shows the current usage and the reset date. Attempting an 11th export returns a quota-exceeded message with the reset date.

Verifying offline with verify.html​

  1. Unzip the bundle
  2. Open verify.html in any modern browser (Chrome, Firefox, Safari, Edge)
  3. The verifier runs entirely locally — no network requests are made
  4. Each entry is verified for:
    • Valid ECDSA P-256 signature against the included public key
    • Correct SHA-256 hash chain linkage to the previous entry
    • Presence of a valid RFC 3161 timestamp token (structure only — TSA revocation checks require network access)
  5. The summary shows a pass/fail count and highlights any failed entries

Verification notice​

The cover.pdf in every bundle includes a plain-language summary of what the cryptographic properties mean: this bundle is tamper-evident and independently verifiable — anyone with the ZIP can confirm that no entry has been altered since it was signed, using only the included verify.html file and a browser.

The notice does not make legal claims. The bundle is a signed, timestamped record of activity. What you do with it is up to you.

Free tier watermark​

On the free tier, bundle exports include a watermark in the cover.pdf indicating "Generated on Attestsys Free Tier — non-qualified timestamp". Per-event timestamps come from an independent public RFC 3161 TSA — they are cryptographically sound but are not backed by a EU Trusted List QTSP. Every event is timestamped this way on all tiers; paid-tier bundles additionally include a daily EU-qualified checkpoint over the audit chain (a qualified RFC 3161 token from an EU Trusted List QTSP that anchors every entry up to the checkpoint), and Enterprise bundles carry per-event qualified timestamps.