Fernway FX-36 E-Bike Battery

Check it yourself

1. Download the records as JSON and the public key.
2. For each record, the chain value is the SHA-256 of: the schema name, the passport ID, the record number, its fingerprint, the previous chain value and the time, one per line.
3. Check the Ed25519 signature of the chain value against the published key. Each record must also name the chain value of the one before it.

import json, hashlib, base64, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

doc = json.load(urllib.request.urlopen("https://myproductpassport.eu/p/3daf1fbb-004d-4881-8515-9571e900f3eb/integrity.json"))
keys = {k["key_id"]: k["public_key"] for k in json.load(urllib.request.urlopen("https://myproductpassport.eu/.well-known/mpp-integrity-keys.json"))["keys"]}
prev = None
for r in doc["records"]:
    line = "\n".join([doc["schema"], doc["passport_uuid"], str(r["sequence"]), r["content_hash"], r["previous_hash"] or "", r["recorded_at"]])
    assert hashlib.sha256(line.encode()).hexdigest() == r["chain_hash"] and r["previous_hash"] == prev
    Ed25519PublicKey.from_public_bytes(base64.b64decode(keys[r["key_id"]])).verify(base64.b64decode(r["signature"]), r["chain_hash"].encode())
    prev = r["chain_hash"]
print("verified", len(doc["records"]), "records")

The fingerprint covers the whole record, including restricted information and a hash of every attached document, so it proves the record has not changed without revealing what it holds. It shows the passport has not been altered since it was recorded; it does not certify that the information in it is correct, which remains the responsibility of the economic operator who published it.