# The verifier's one package: RFC 8785 (JCS) canonicalisation, Trail of Bits,
# Apache-2.0, pure Python. Pinned by version AND hash to the exact release the
# producer runs (apps/api/uv.lock), which the api suite asserts.
#   python3 -m pip install --require-hashes -r verifier/requirements.txt
rfc8785==0.1.4 \
    --hash=sha256:520d690b448ecf0703691c76e1a34a24ddcd4fc5bc41d589cb7c58ec651bcd48 \
    --hash=sha256:e545841329fe0eee4f6a3b44e7034343100c12b4ec566dc06ca9735681deb4da