Verify Prices

Every price list on Wholesale Dito Store is signed with a cryptographic key. Using our public key, anyone can confirm that a list was issued by us and that it has not been changed since it was signed.

Index signature verified on this server

Current status

Last signed
8 hours ago
2026-09-12T03:19:27Z
Total manifests
480
411 products, 69 brands
Signed by
Clickerwayne-Provenance-Engine/1.5
ECDSA P-256, SHA-256

How to verify a price

  1. Get the manifest for the product or brand. Each product page links to its own signed manifest. You can also browse the full index.
  2. Download the public key. public_key.pem. This file is the only piece you need to trust for verification to mean anything.
  3. Canonicalize the claim. Take the claim object from the manifest, sort every key in it alphabetically at every level of nesting, then encode it as JSON with unescaped slashes and unicode.
  4. Verify the signature. Decode the base64 signature field and check it against the canonicalized claim using an ECDSA P-256 library, or with openssl.
    Show the openssl command 
     # Save the claim and the decoded signature, then: openssl dgst -sha256 -verify public_key.pem \ -signature signature.bin claim.json
  5. Check revocations. Confirm the manifest's instance_id is not listed in revocations.json.

Public key

Compare this fingerprint with the one in any manifest you download. They have to match.

SHA-256 fingerprint
da41 7e12 4f87 3820 3ccb 0c47 ffcd e475 4823 b599 722b 9481 df95 9f13 c659 92b9

Download public_key.pem

Browse manifests

Brands (69)

Products (411)

Questions

What does the signature actually prove?

It proves that a manifest was issued by the holder of our private key, and that the manifest content has not been changed since it was signed. It does not prove where the data came from, and it does not prove that the prices on this website match the manifest at every moment.

Why sign prices at all?

Signed manifests let customers, partners, and auditors check that a price list is authentic without depending on our website to tell them the truth. If a list is modified in transit, the signature will fail to verify.

What if a signature does not verify?

Contact us using the details in the footer. Include the manifest URL, the fingerprint you saw, and the exact error message from openssl.

How often are manifests regenerated?

The generator runs on a scheduled basis. The Last signed field above shows the time of the most recent run in UTC.

Where can I find previous versions?

Dated copies are kept under /.well-known/provenance/archive/. They are historical records. The version linked from the index above is the one to trust as current.

Technical details

Instance ID of this index
xmpid:index-5795dffe4f4d4cb0
Algorithm
ES256
ECDSA, P-256, SHA-256
Canonicalization
recursive-ksort
JSON keys sorted, unescaped slashes and unicode
Signature format
DER, base64
Raw DER then base64 encoded

Files

Price lists are signed by Clickerwayne-Provenance-Engine/1.5. If a signature fails to verify, contact us and include the manifest URL and the error from openssl.