The whole receipt, as downloaded, including its signature.
Show the verifier's raw answer
1
Canonical form
The receipt's payload is written out in one exact byte order (RFC 8785), so the same facts always produce the same bytes.
2
Fingerprint
Its SHA-256 digest must equal the one the receipt carries. Change any figure and the fingerprint no longer matches.
3
Signature
The Ed25519 signature must check against a Vugo Measure public key. Only Vugo Measure holds the private half.
You need not trust this page: the public keys are published at .well-known/jwks.json, and any Ed25519 library can repeat these three steps offline.