{
  "schema_version": 1,
  "recorded_at": "2026-10-10T02:04:04+00:00",
  "scope": "Read-only artifact checks of the publicly downloaded v1.22.5 DMG. No app launch, installation, system-extension activation, scan, runtime benchmark or detection exercise was performed.",
  "operator": "MacCrab website maintenance review",
  "verification_host": {
    "macos": "26.6.2",
    "build": "25G83",
    "architecture": "arm64"
  },
  "release_page": "https://github.com/peterhanily/maccrab/releases/tag/v1.22.5",
  "artifact": {
    "url": "https://github.com/peterhanily/maccrab/releases/download/v1.22.5/MacCrab-v1.22.5.dmg",
    "filename": "MacCrab-v1.22.5.dmg",
    "size_bytes": 81388292,
    "sha256": "d04fd517004ba5f349248aa789cde65e4e858b3b77d33121a47248d1e9f76ce9",
    "github_asset_digest": "sha256:d04fd517004ba5f349248aa789cde65e4e858b3b77d33121a47248d1e9f76ce9",
    "app_version": "1.22.5",
    "app_build": "1.22.5.1216",
    "minimum_macos": "13.0",
    "architectures": [
      "x86_64",
      "arm64"
    ]
  },
  "source_attestation": {
    "source_commit": "0ebcba9f63cc3acc308bf3bc00c693c8d6a6f785",
    "source_tree": "3f406fc1056373dd28e67f4b80f8ef520e582a5a",
    "sha256": "103078911ed0a78eed1a62407aa3637170dafe317007e2a8d3086f513ec07436",
    "extracted_file": "release-input-attestation.txt",
    "meaning": "Publisher-provided build-input identity inside the signed app. This review matched the attestation to release.json; it did not independently reproduce the build."
  },
  "checks": [
    {
      "check": "Disk image code signature",
      "command": [
        "codesign",
        "--verify",
        "--verbose=2",
        "$DMG"
      ],
      "exit_code": 0,
      "output": "$DMG: valid on disk\n$DMG: satisfies its Designated Requirement"
    },
    {
      "check": "Disk image signing identity",
      "command": [
        "codesign",
        "-dvv",
        "$DMG"
      ],
      "exit_code": 0,
      "output": "Executable=$DMG\nIdentifier=MacCrab-v1\nFormat=disk image\nCodeDirectory v=20200 size=298 flags=0x0(none) hashes=1+6 location=embedded\nSignature size=8974\nAuthority=Developer ID Application: Peter Hanily (79S425CW99)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=4 Oct 2026 at 18:32:00\nNotarization Ticket=stapled\nInfo.plist=not bound\nTeamIdentifier=79S425CW99\nSealed Resources=none\nInternal requirements count=1 size=172"
    },
    {
      "check": "Stapled notarization ticket",
      "command": [
        "xcrun",
        "stapler",
        "validate",
        "$DMG"
      ],
      "exit_code": 0,
      "output": "Processing: $DMG\nThe validate action worked!"
    },
    {
      "check": "Disk image Gatekeeper assessment",
      "command": [
        "spctl",
        "--assess",
        "--type",
        "open",
        "--context",
        "context:primary-signature",
        "--verbose=2",
        "$DMG"
      ],
      "exit_code": 0,
      "output": "$DMG: accepted\nsource=Notarized Developer ID"
    },
    {
      "check": "App code signature and nested code",
      "command": [
        "codesign",
        "--verify",
        "--deep",
        "--strict",
        "--verbose=2",
        "$APP"
      ],
      "exit_code": 0,
      "output": "--prepared:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/.\n--prepared:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/Autoupdate\n--validated:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/Autoupdate\n--prepared:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/Updater.app\n--validated:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/Updater.app\n--prepared:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/XPCServices/Downloader.xpc\n--validated:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/XPCServices/Downloader.xpc\n--prepared:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/XPCServices/Installer.xpc\n--validated:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/XPCServices/Installer.xpc\n--validated:$APP/Contents/Frameworks/Sparkle.framework/Versions/Current/.\n$APP: valid on disk\n$APP: satisfies its Designated Requirement"
    },
    {
      "check": "App signing identity",
      "command": [
        "codesign",
        "-dvv",
        "$APP"
      ],
      "exit_code": 0,
      "output": "Executable=$APP/Contents/MacOS/MacCrab\nIdentifier=com.maccrab.app\nFormat=app bundle with Mach-O universal (x86_64 arm64)\nCodeDirectory v=20500 size=51931 flags=0x10000(runtime) hashes=1612+7 location=embedded\nSignature size=8974\nAuthority=Developer ID Application: Peter Hanily (79S425CW99)\nAuthority=Developer ID Certification Authority\nAuthority=Apple Root CA\nTimestamp=4 Oct 2026 at 18:31:31\nInfo.plist entries=27\nTeamIdentifier=79S425CW99\nRuntime Version=26.4.0\nSealed Resources version=2 rules=13 files=1564\nInternal requirements count=1 size=176"
    },
    {
      "check": "App Gatekeeper assessment",
      "command": [
        "spctl",
        "--assess",
        "--type",
        "execute",
        "--verbose=2",
        "$APP"
      ],
      "exit_code": 0,
      "output": "$APP: accepted\nsource=Notarized Developer ID"
    },
    {
      "check": "System extension code signature",
      "command": [
        "codesign",
        "--verify",
        "--strict",
        "--verbose=2",
        "$APP/Contents/Library/SystemExtensions/com.maccrab.agent.systemextension"
      ],
      "exit_code": 0,
      "output": "$APP/Contents/Library/SystemExtensions/com.maccrab.agent.systemextension: valid on disk\n$APP/Contents/Library/SystemExtensions/com.maccrab.agent.systemextension: satisfies its Designated Requirement"
    },
    {
      "check": "System extension entitlements",
      "command": [
        "codesign",
        "-d",
        "--entitlements",
        "-",
        "$APP/Contents/Library/SystemExtensions/com.maccrab.agent.systemextension"
      ],
      "exit_code": 0,
      "output": "[Dict]\n\t[Key] com.apple.developer.endpoint-security.client\n\t[Value]\n\t\t[Bool] true\n\t[Key] keychain-access-groups\n\t[Value]\n\t\t[Array]\n\t\t\t[String] 79S425CW99.com.maccrab.shared\nExecutable=$APP/Contents/Library/SystemExtensions/com.maccrab.agent.systemextension/Contents/MacOS/com.maccrab.agent"
    }
  ],
  "sparkle_update_signature": {
    "algorithm": "Ed25519",
    "signature": "khq/4aZEknQr20O8Z4Ev7iUEiUZGKPHU3/w0lGNEBAx+nlffkT9sDBGwaBMMSjeXtv3OojsdwavLRPBQVQXZBg==",
    "public_key": "de+dzPjBve7LP5qxoE7nR6shThsjubkVasi+i8ehT4E=",
    "key_source": "SUPublicEDKey in the code-signature-verified app Info.plist",
    "signature_source": "v1.22.5 enclosure in appcast.xml",
    "verified": true,
    "method": "Node.js crypto.verify(null, downloadedDmgBytes, SPKI-wrapped Ed25519 public key, decoded signature). This checks the signature, not a running Sparkle update."
  },
  "not_verified": [
    "Clean installation and permission approval",
    "Sensor event receipt after installation or restart",
    "Detection efficacy or false-positive rates",
    "CPU, memory, storage growth or disk activity",
    "Upgrade, rollback and extension removal",
    "Agent version compatibility or runtime trace propagation",
    "A current native screenshot of v1.22.5"
  ],
  "evidence_limits": "These successful checks establish artifact integrity, publisher identity, notarization and update-signature consistency at the recorded time. They do not establish detection quality, runtime reliability, source-to-binary reproducibility or qualification on the full supported OS/hardware matrix.",
  "source_records": {
    "release_metadata_snapshot": "release-metadata.json",
    "github_release_api": "https://api.github.com/repos/peterhanily/maccrab/releases/tags/v1.22.5",
    "appcast": "https://maccrab.com/appcast.xml",
    "source_documentation_ref": "v1.22.5"
  }
}