This only validates the signature directions themselves, not the actual archive files. To validate a file, a digest value in the signature file is compared against a digest calculated against the corresponding entry in the manifest file. Another requirement to validate the signature on a given manifest entry is that the verifier understand the value or values of the Magic key-pair value in that entry's manifest entry. The Magic key is optional but it is required that a parser understand the value of an entry's Magic key if it is verifying that entry's signature. The spaces before and after the commas are ignored.
Case is ignored.
The exact meaning of the magic keywords is application specific. These keywords indicate how to compute the hash value contained in the manifest entry, and are therefore crucial to the proper verification of the signature. The keywords may be used for dynamic or embedded content, multiple hashes for multilingual documents, etc. In the first example, these Magic values may indicate that the result of an http query is the script embedded in the document, as opposed to the document itself, and also that the script is generated dynamically. These two pieces of information indicate how to compute the hash value against which to compare the Manifest's hash value, thus comparing a valid signature.