Use Node.js 22 or newer. Extract the ZIP before checking. Obtain verify.mjs and a historical service public key independently from the authenticated app.
node /path/to/independent/verify.mjs --root /path/to/extracted/snapshot --trusted-key /path/to/independent-key.pem --json
Exit 0: integrity match and supplied trusted signature. Exit 1: integrity/signature failure. Exit 2: malformed/unsupported/usage error. Exit 3: integrity match but issuer trust unresolved.
The bundled key and checker do not establish issuer identity. Offline key revocation status is unknown. Keep verification results outside the extracted package.
