Don't trust this page

// node >= 20 — reads the root tx, then every chunk, and rebuilds the asset
import { createHash } from 'node:crypto';
import { gunzipSync } from 'node:zlib';
import bs58 from 'bs58';

const RPC = 'https://api.devnet.solana.com';
const ROOT = '<ROOT_SIGNATURE>';

// The RPC's json encoding returns instruction data as base58 when it is
// 128 bytes or fewer and base64 when it is longer. Accept whichever arrives.
const data = async (sig, magic) => {
  const r = await fetch(RPC, { method: 'POST', headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'getTransaction',
      params: [sig, { encoding: 'json', maxSupportedTransactionVersion: 0 }] }) });
  const d = (await r.json()).result.transaction.message.instructions[0].data;
  const ok = (b) => Buffer.from(b.subarray(0, 4)).toString() === magic;
  if (!/[+/=]/.test(d)) { try { const b = bs58.decode(d); if (ok(b)) return b; } catch {} }
  const b = Buffer.from(d, 'base64');
  if (!ok(b)) throw new Error('undecodable instruction data');
  return b;
};

const root = JSON.parse(Buffer.from(await data(ROOT, 'GRT1')).subarray(4).toString()); // manifest
const sigs = [];
for (const page of root.pages) {                                                       // GIX1 + sigs
  const b = Buffer.from(await data(page, 'GIX1')), n = b.readUInt32LE(4);
  for (let i = 0; i < n; i++) sigs.push(bs58.encode(b.subarray(8 + i * 64, 8 + (i + 1) * 64)));
}

const out = Buffer.alloc(root.size);
for (const sig of sigs) {                                                              // GCH1 + idx + len
  const b = Buffer.from(await data(sig, 'GCH1'));
  b.copy(out, b.readUInt32LE(4) * root.chunkSize, 12, 12 + b.readUInt32LE(8));
}

const hash = createHash('sha256').update(out).digest('hex');
console.log(hash === root.sha256 ? 'MATCH' : 'MISMATCH', hash);
// root.gzip ? gunzipSync(out) : out  ->  the game, byte for byte