# The Steam Dossier — reading files

English edition · 18 October 2026 · 39 documents

Library: https://phishdestroy.io/steam_dossier/reading_files

## What is included

- `en/*.pdf`: individual reading editions with clickable contents, page numbers, source links and selected figures.
- `en/*.content.json`: article text, headings, tables, links, cited-source identifiers, export scope and exact PDF SHA-256.
- `en/*.md`: the same prepared article as Markdown.
- `steam-dossier-reading-pack.pdf`: the complete collection, with a document index and bookmarks.
- `steam-dossier-reading-pack.content.json`: collection page ranges, embedded article JSON and the complete PDF digest.
- `catalogue.json`: titles, topics, file sizes, page counts and download links.
- `article.schema.json`: JSON Schema for the individual article files.
- `edition-notes.json`: changes and evidence-scope clarifications.
- `manifest.json`: the signed inventory of package files.

Article JSON describes the published article. It is separate from the underlying source datasets. A collection row, a screenshot, a source group and a confirmed event are different units. Full interactive datasets remain linked; article-specific omissions are declared.

The unverified Source 1 response annex is excluded. Earlier signed editions and translations are preserved at their original addresses and retain their original dates.

## Verify the downloaded package

Unpack `reading-files.zip`. With Python 3.9+ and GnuPG installed, run:

```sh
python3 verify-reading-files.py
```

The utility verifies the manifest signature, checks every listed file, verifies the individual JSON signatures and checks the PDF digests. It makes no network requests and uses a temporary GnuPG keyring.

Expected signing-key fingerprint:

```text
129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01
```

Check the published key independently at https://phishdestroy.io/.well-known/pgp-key.txt. A key distributed inside a package should not be your only basis for trusting that package.

For a single article, verify the detached `.content.json.asc` signature against the JSON, then compare the PDF SHA-256 with the `pdf.sha256` field. The `.sha256` file is a checksum of the JSON itself. These are detached JSON signatures, not embedded PDF document signatures.

The signed manifest lists package contents except itself and its signature/checksum. The downloadable ZIP and its digest are described separately in signed `distribution.json`; they are not included in the ZIP they describe.

## Rights and evidence limits

Authored research is CC0 1.0. Third-party screenshots, statements and source materials retain their own rights and attribution. The separate signed rights statement remains at https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json.

Cryptographic verification establishes publication integrity. It does not independently authenticate third-party reports or establish the merits of an allegation.