topace_: okay excellent, i think that gives me enough to get this implemented tomorrow.. bedtime now! thanks for your help!

topace_: if i was going to do a digest of the whole message, i'd have to do it based on a post-processed data (removing the comments and the blank lines, etc)

topace_: then i should still take a hash of the signature, and use the hash as my unique identifier?

topace_: so i end up with just iD8DBQFRJRZakhT8a/G2mSERAtfRAJ9LBtdI5x2a7WwNqZMTLLoaWV/rFACfRvtQn9TB69az5+U9gPxX7BRkrgg

topace_: then using that as my unique identifier to ensure i never double-process the same receipt?

topace_: so i'd also have to trim off the = before the =4chr

topace_: but if there's no way of knowing how long the signature is expected to be, and it allows adding crap at the end, again, how do i know where to stop reading the characters of the 'actual' signature

topace_: so if there can be crap after the end, how do i know where to stop reading characters that are actually part of the signature

topace_: so how can i reliably filter out just the signature? if there's no logical separator?

topace_: hmm nope, i can concatenate the two lines into one and it validates.. i can combine all 3 lines onto one, and it validates too...

topace_: ahh, so I should only be considering the 2 lines of the signature hash?

topace_: i can actually add anything concatenated to the end

topace_: if i add a 1 to teh end of it, it still validates

topace_: and if i try to just grab the actual signature hash, that can still be changed adn still validate

topace_: i can change that line on the receipt and it still validates

topace_: i cant just hash the receipt to get a unique id because then doing something as simple as changing the comment in th e sig would change the hash and stilll validate