# AGEX Secure Package Review Before Handoff

Generate a test signing key, inspect AGEX bundle metadata, verify its signature with a trusted public key, and stop the handoff when evidence is incomplete.

> Canonical page: https://elysiatools.com/en/hubs/agex-secure-package-review

- **Keywords:** AGEX package review, bundle signature verification, AGEX metadata inspection, Ed25519 test key, secure handoff acceptance

## Frequently asked questions

### Does generating a keypair establish that a bundle is from the right producer?

No. It creates test signing material. Provenance requires a signature made with the expected private key and a public key or fingerprint that was trusted independently of this review.

### What should I do if the signature verifier fails?

Stop the handoff, preserve the original bundle and reports, check that the bytes and public key are the intended ones, and obtain a corrected artifact or confirmed trust record. Do not treat a failed check as an advisory warning.

### Why inspect metadata if the signature is valid?

A valid signature covers the signed artifact, but it does not make unexpected filenames, MIME types, versions, or signer labels acceptable. Metadata is part of the package acceptance context.

### Does this workflow prove the whole software supply chain is safe?

No. It supplies focused evidence about the selected bundle and signature. Build provenance, dependencies, transport, endpoint identity, and operational controls need separate review.

## Related content

- [AGEX Secure File Packaging and Handoff](https://elysiatools.com/en/hubs/agex-secure-file-sharing): Package a file as AGEX, inspect visible metadata, choose passphrase and signature settings, and verify the handoff before delivery.