# The local release manifest

The profile identifier is `qgpl.single.ml-dsa65.v1`. It is separate from the
historical planning draft's version numbering.

The complete document must be a JSON object with exactly these members.

| Member | Required value or meaning |
| --- | --- |
| `qgpl_toolkit` | `0.1.0` |
| `profile` | `qgpl.single.ml-dsa65.v1` |
| `license` | `LicenseRef-QGPL-3.0` or `LicenseRef-QGPL-3.1-draft` |
| `artifact` | The safe filename, byte length and SHA-256 hash |
| `signature` | ML-DSA-65 signature bytes in canonical base64 and an asserted UTC time |
| `public_key` | ML-DSA-65 public key bytes in canonical base64 and SHA-256 fingerprint |

The artifact object has exactly `name`, `size` and `hash`. The hash object
has exactly `alg` and `value`. The signature object has exactly `alg`, `value`
and `signed_at`. The public key object has exactly `alg`, `value` and
`fingerprint`.

The hash value is lowercase hexadecimal. The fingerprint is `sha256` followed
by the standard separator and lowercase hexadecimal of the raw public key
bytes. The timestamp uses the UTC form exemplified by `2026-10-24T12:00:00Z`.

To sign, copy the complete document, set `signature.value` to the empty
string, serialize it using RFC 8785 and sign those bytes with ML-DSA-65.
Encode the signature into `signature.value`. The verification process uses
the same rule. There are no unsigned extension fields.

Duplicate members, unknown members, unsafe filenames, invalid base64,
unsupported algorithms, invalid timestamps and non-finite values are
rejected. The JSON input limit is one MiB. Artifact hashes are streamed.

The embedded key provides cryptographic self consistency. Trust requires a
separately authenticated fingerprint. Never accept a fingerprint received
through the same untrusted channel as the artifact as independent evidence.