Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Independent publication evidence review

PASS within the bounded retained-evidence review after one wording correction. Both source and public publication copies have identical reviewed bytes. The original candidate remains preserved.

The reviewer independently recomputed the sealed seven-asset inventory and exact five-entry checksum manifest, compared all four archives with immutable source commit 23ba013d9b57588a58faf6c7ba4b16a9ecd3085f, and checked full README, LICENSE and CHANGELOG bytes, including the Windows ZIP. All four npm platform binaries match their source archive binaries. All five package tarball SHA512 SRI values, launcher version, four exact optional dependency versions, retained host bytes and proof digests agree.

The original final paragraph and receipt limit implied broader historical preservation than the measured evidence supported. The two revised strings now describe this audit’s actions and explicitly avoid an exhaustive older-state claim. No other README or receipt bytes changed. Final SHA256:

  • README.md: 1ee849bdf0b5969c2f5161b957232199959a5d7afbcb06cf63f251e9f4c86035
  • receipt.json: c522056423f4fa465ee7a983c10c2b1859e60685455de3f9db3110666c1d19e9

The retained real cosign command uses the exact source tagged workflow identity and GitHub Actions issuer with the sealed checksum subject and pinned tool digest. This review inspected that proof but did not rerun cosign. npm provenance metadata presence is distinct from independent provenance signature verification.

Actual postpublication execution was performed by the producer-repair author. This reviewer previously prepared the reusable private verification helpers, and now independently recomputed the retained-byte comparisons directly with stdlib rather than importing those helpers. Neither role is presented as a fresh independent attack on the publication pipeline. The separate original independent producer 8/8 campaign remains distinct and was not replayed.

No fresh network acquisition, installation, binary execution, publication, build or GUI action was performed. Original host execution covers macOS arm64; other platforms have archive, SRI and byte-identity proof plus their retained hosted build outcomes. Setup-invalid and partial acquisitions remain separately recorded. No exhaustive baseline of older publication state is claimed. Public candidate and report scans found no private absolute paths, raw logs or credential material. Detailed checks and limits are in independent.json.