[Replay Bug]: ReplayWeb.page reports WACZ validation failure for ArchiveWeb.page export despite matching file and digest hashes

[xorphansec]

ReplayWeb.page Version

v2.4.4

What did you expect to happen? What happened instead?

WACZ archives exported from ArchiveWeb.page v0.16.2 are reported as partially invalid in ReplayWeb.page, even though file integrity and digest-level verification appear correct.

Expected behavior: WACZ archive should validate successfully in ReplayWeb.page.
Actual behavior: ReplayWeb.page shows: 1 hashes verified, 2 invalid

Verification already performed:

• All file hashes in datapackage.json match computed SHA-256 values
• datapackage.json hash matches the value in datapackage-digest.json
• signedData is present and complete, including: hash, signature, publicKey, created, software

At the file and digest level, the archive appears consistent and unmodified. The failure occurs only during the higher-level validation step in ReplayWeb.page, which likely involves signature verification and/or reconstruction of the signed input data.

Is there a known incompatibility or change in how ReplayWeb.page verifies signatures compared to ArchiveWeb.page?