com.pipobscure.bundle.attestation

A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a bad one refuses the suite, and does not carry over to its bundles.