# Verify a forensics report export hasn't been tampered with
import hmac, hashlib, json

def verify_report_signature(
    secret_key: bytes,
    report_id: str,
    generated_at: str,        # ISO 8601 UTC
    chain_valid: bool,
    total_entries: int,
    entries_verified: int,
    signature_hex: str,
) -> bool:
    payload = {
        "entries_verified": entries_verified,
        "chain_valid": chain_valid,
        "generated_at": generated_at,
        "report_id": report_id,
        "total_entries": total_entries,
    }
    msg = json.dumps(payload, sort_keys=True, separators=(",", ":"))
    expected = hmac.new(secret_key, msg.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_hex)