Check the signature of the manifest file inside a SOL004 package.
From the ETSI GS NFV-SOL 004 V2.6.1, item 5.2:

In option1 the VNF package authenticity is ensured by signing the manifest file with the VNF provider private key. The
digital signature is stored in the manifest file itself (see clause 5.3). The VNF provider shall include an X.509
certificate [8] in the VNF Package.