{
  "schemaVersion": "atlas.download-trust/1",
  "sequence": 47,
  "publishedAt": "2026-10-11T00:30:56Z",
  "ring": "pilot",
  "sourceSha": "b825d7668683417cea46478f5638170a6f1d29aa",
  "build": {
    "agentVersion": "0.1.49",
    "packageVersion": "0.1.49",
    "macosPackageVerificationSha256": "880a530d013e580c071894bb57d65a935d359ec1847e469de8d0349fa5c4fab0"
  },
  "artifacts": [
    {
      "platform": "macos",
      "kind": "atlas-macos-pkg/1",
      "fileName": "PoolParty_0.1.49_macos_arm64_signed-notarized.pkg",
      "sha256": "76563ab94adc3b5cf189d36f0dd3390e98aef867761608751439cbb3068954a5",
      "sizeBytes": 101157029,
      "targetName": "channels/pilot/macos/aarch64/atlas-installer.pkg",
      "packageVersion": "0.1.49",
      "signed": true,
      "signing": {
        "appleTeamId": "GX5PPL2TVY",
        "notarySubmissionId": "b3729b3e-388e-44f5-8933-0422775ee8ef"
      },
      "verification": {
        "notarized": true,
        "stapled": true,
        "gatekeeperAccepted": true
      }
    },
    {
      "platform": "macos",
      "kind": "atlas-agent-executable/1",
      "fileName": "poolparty-agent",
      "sha256": "3de746b6248ebb24619e7c13abbf7251e2f8db497a3598f6ee3efe48c90a2faa",
      "sizeBytes": 51896352,
      "targetName": "channels/pilot/macos/aarch64/atlas-agent",
      "packageVersion": null,
      "signed": true
    },
    {
      "platform": "linux",
      "kind": "atlas-linux-deb/1",
      "fileName": "poolparty_0.1.49_arm64.deb",
      "sha256": "3f5bb0588f6156c008d1fd17e550178eaeb069d4c4703c693535f87a92cba67d",
      "sizeBytes": 80230922,
      "targetName": "channels/pilot/linux/aarch64/atlas-agent.deb",
      "packageVersion": "0.1.49",
      "signed": false,
      "linux": {
        "debPackageName": "poolparty",
        "debArchitecture": "arm64"
      }
    },
    {
      "platform": "linux",
      "kind": "atlas-linux-tarball/1",
      "fileName": "atlas-agent_0.1.49_linux_aarch64.tar.gz",
      "sha256": "332383ab89a5078c1e18dfc262d25c896bc3eb836b93e32496dca804931c3699",
      "sizeBytes": 13128356,
      "targetName": "channels/pilot/linux/aarch64/atlas-agent.tar.gz",
      "packageVersion": "0.1.49",
      "signed": false
    },
    {
      "platform": "linux",
      "kind": "atlas-agent-executable/1",
      "fileName": "atlas-agent",
      "sha256": "e17fcad606d2e05300818cd47982626b4e3dc836917b0fc358bf56258b3c83cd",
      "sizeBytes": 36526032,
      "targetName": "channels/pilot/linux/aarch64/atlas-agent",
      "packageVersion": null,
      "signed": false
    },
    {
      "platform": "all",
      "kind": "atlas-commons-workloads/1",
      "fileName": "commons-workloads.json",
      "sha256": "d0cbf1b3398e4f3e94444d9c14f426a4a1ba53eebfdffc67dc5d98780fa565ff",
      "sizeBytes": 933,
      "targetName": "channels/pilot/all/all/commons-workloads.json",
      "packageVersion": null,
      "signed": false
    },
    {
      "platform": "linux",
      "kind": "atlas-linux-deb/1",
      "fileName": "poolparty_0.1.49_amd64.deb",
      "sha256": "baae9492ebeb49ca95db2b9c591e06e0cf4fb5d34847dded28f75706cc8a276d",
      "sizeBytes": 82386122,
      "targetName": "channels/pilot/linux/x86_64/atlas-agent.deb",
      "packageVersion": "0.1.49",
      "signed": false,
      "linux": {
        "debPackageName": "poolparty",
        "debArchitecture": "amd64"
      }
    },
    {
      "platform": "linux",
      "kind": "atlas-linux-tarball/1",
      "fileName": "atlas-agent_0.1.49_linux_x86_64.tar.gz",
      "sha256": "443e79b8df185f1d8640be6dd7373daf01cd20f37e079481c958067c3764cdba",
      "sizeBytes": 14124364,
      "targetName": "channels/pilot/linux/x86_64/atlas-agent.tar.gz",
      "packageVersion": "0.1.49",
      "signed": false
    },
    {
      "platform": "linux",
      "kind": "atlas-agent-executable/1",
      "fileName": "atlas-agent",
      "sha256": "c82b90ed5f593a730bbe9fb218c17fd35cf00efbda63bc35b89c20ef31eb9a56",
      "sizeBytes": 42699328,
      "targetName": "channels/pilot/linux/x86_64/atlas-agent",
      "packageVersion": null,
      "signed": false
    },
    {
      "platform": "windows",
      "kind": "atlas-windows-msi-unsigned/1",
      "fileName": "PoolParty_0.1.49_windows_x64_unsigned-beta.msi",
      "sha256": "6f1df56ddcdba8fe6433c94852600cd2ad0ac4cfd8d57a42b907774476533eb0",
      "sizeBytes": 85989901,
      "targetName": "channels/pilot/windows/x86_64/atlas-agent.msi",
      "packageVersion": "0.1.49",
      "signed": false,
      "windows": {
        "authenticodeSigned": false,
        "smartScreenWillWarn": true,
        "msiProductCode": "a4392534-1a65-8f1d-b202-344b595c7d4b",
        "msiUpgradeCode": "8f4c2c1e-7b6d-4d3a-9e21-5a0c9b7f2d61"
      }
    }
  ],
  "tuf": {
    "trustedRootSha256": "fcc10945e120d19d2745b6fb2c9dff8e18811cf11ef2f8ec1602417fbe526f85",
    "trustedRootKnownAtPublish": true,
    "trustedRootVersion": 1,
    "metadataRoute": "/download/tuf/metadata/",
    "targetsRoute": "/download/tuf/targets/",
    "targetNames": [
      "channels/pilot/macos/aarch64/atlas-installer.pkg",
      "channels/pilot/macos/aarch64/atlas-agent",
      "channels/pilot/linux/aarch64/atlas-agent.deb",
      "channels/pilot/linux/aarch64/atlas-agent.tar.gz",
      "channels/pilot/linux/aarch64/atlas-agent",
      "channels/pilot/all/all/commons-workloads.json",
      "channels/pilot/linux/x86_64/atlas-agent.deb",
      "channels/pilot/linux/x86_64/atlas-agent.tar.gz",
      "channels/pilot/linux/x86_64/atlas-agent",
      "channels/pilot/windows/x86_64/atlas-agent.msi",
      "channels/pilot/all/all/trust.json"
    ]
  },
  "notices": {
    "sha256": "67b465aafd573845caaf71e041cf755362e173918c06b8ce71ef0a379b504780",
    "sizeBytes": 206923
  },
  "sha256sums": {
    "sha256": "b0e3809a893902e4ee7c2b88631d65d59d419726d5372296a07817a8f51659de",
    "sizeBytes": 626,
    "route": "/download/SHA256SUMS"
  },
  "sboms": [
    {
      "fileName": "atlas-source-b825d7668683.cdx.json",
      "scope": "source",
      "subject": "source tree at b825d7668683417cea46478f5638170a6f1d29aa",
      "sha256": "8471dba6d146f5c31a51471a8760ce2c46bade9845bf6098d99ac321a588bd22",
      "sizeBytes": 2960576,
      "format": "CycloneDX",
      "route": "/download/sbom/atlas-source-b825d7668683.cdx.json"
    },
    {
      "fileName": "PoolParty_0.1.49_macos_arm64_signed-notarized.pkg.cdx.json",
      "scope": "package",
      "subject": "PoolParty_0.1.49_macos_arm64_signed-notarized.pkg",
      "sha256": "ee5b0b44b6241da014761945ff8793c049fdf84a42cc8eecf5527ab20907e2d6",
      "sizeBytes": 6056436,
      "format": "CycloneDX",
      "route": "/download/sbom/PoolParty_0.1.49_macos_arm64_signed-notarized.pkg.cdx.json"
    },
    {
      "fileName": "poolparty_0.1.49_arm64.deb.cdx.json",
      "scope": "package",
      "subject": "poolparty_0.1.49_arm64.deb",
      "sha256": "7934f37126b67a3c59fc5841228301748551ee97f69e1a483f5172263c101634",
      "sizeBytes": 1809,
      "format": "CycloneDX",
      "route": "/download/sbom/poolparty_0.1.49_arm64.deb.cdx.json"
    },
    {
      "fileName": "atlas-agent_0.1.49_linux_aarch64.tar.gz.cdx.json",
      "scope": "package",
      "subject": "atlas-agent_0.1.49_linux_aarch64.tar.gz",
      "sha256": "7aff9ec6c54ab3aca43c41860e785525dd78054711e1ef4404eedfd4cd017db1",
      "sizeBytes": 3104,
      "format": "CycloneDX",
      "route": "/download/sbom/atlas-agent_0.1.49_linux_aarch64.tar.gz.cdx.json"
    },
    {
      "fileName": "poolparty_0.1.49_amd64.deb.cdx.json",
      "scope": "package",
      "subject": "poolparty_0.1.49_amd64.deb",
      "sha256": "1f0e71e1960b8bc3726e60b3ba3bc7b208b8a1d34fc32d8228aac535d7ac9ded",
      "sizeBytes": 1809,
      "format": "CycloneDX",
      "route": "/download/sbom/poolparty_0.1.49_amd64.deb.cdx.json"
    },
    {
      "fileName": "atlas-agent_0.1.49_linux_x86_64.tar.gz.cdx.json",
      "scope": "package",
      "subject": "atlas-agent_0.1.49_linux_x86_64.tar.gz",
      "sha256": "79865f85573842981f22a11cc6a446f4092bac1148b2db41fde7e3660e2d992e",
      "sizeBytes": 3096,
      "format": "CycloneDX",
      "route": "/download/sbom/atlas-agent_0.1.49_linux_x86_64.tar.gz.cdx.json"
    }
  ],
  "cveStatus": {
    "schemaVersion": "atlas.download-cve-status/1",
    "ran": true,
    "ranAt": "2026-10-10T18:42:29Z",
    "sourceSha": "b825d7668683417cea46478f5638170a6f1d29aa",
    "tools": [
      {
        "name": "cargo-audit",
        "version": "cargo-audit-audit 0.22.2",
        "lockfile": "Cargo.lock",
        "database": {
          "advisoryCount": 1296,
          "lastCommit": "7eebec69c352c7191b1f13eb95dd510eeca5d1de",
          "lastUpdated": "2026-10-09T10:12:02+02:00"
        },
        "vulnerabilities": {
          "count": 3,
          "ids": [
            "RUSTSEC-2026-0327",
            "RUSTSEC-2026-0326",
            "RUSTSEC-2026-0325"
          ]
        },
        "warnings": {
          "yanked": 1
        },
        "ignoredAdvisories": [
          {
            "id": "RUSTSEC-2023-0089",
            "reason": "atomic-polyfill is unmaintained (heapless ← postcard's default heapless-cas ← iroh-blobs and iroh-tickets; heapless takes it only on AVR and on the riscv32i-unknown-none-elf, riscv32imc-unknown-none-elf, thumbv6m-none-eabi and xtensa-esp32s2-none-elf targets, so no target this repository builds compiles it)"
          },
          {
            "id": "RUSTSEC-2024-0436",
            "reason": "paste is no longer maintained (netlink-packet-core ← netdev/netwatch ← iroh)"
          },
          {
            "id": "RUSTSEC-2024-0370",
            "reason": "proc-macro-error is unmaintained, a build-time macro in both lockfiles (the agent's: genawaiter-proc-macro ← genawaiter ← bao-tree/iroh-blobs; the tray's: glib-macros and gtk3-macros, the Linux GTK stack's, shipped since sequence 42)"
          },
          {
            "id": "RUSTSEC-2025-0081",
            "reason": "unic-char-property is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0075",
            "reason": "unic-char-range is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0080",
            "reason": "unic-common is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0100",
            "reason": "unic-ucd-ident is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0098",
            "reason": "unic-ucd-version is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2024-0429",
            "reason": "glib 0.18 VariantStrIter unsoundness (gtk/gdk/gio/webkit2gtk ← tauri and tauri-runtime-wry, and libappindicator ← tray-icon; compiled into the Linux tray, shipped since sequence 42; the tray's own code calls no glib; it leaves when Tauri's GTK stack moves)"
          }
        ],
        "exitStatus": 1
      },
      {
        "name": "cargo-audit",
        "version": "cargo-audit-audit 0.22.2",
        "lockfile": "apps/tray/src-tauri/Cargo.lock",
        "database": {
          "advisoryCount": 1296,
          "lastCommit": "7eebec69c352c7191b1f13eb95dd510eeca5d1de",
          "lastUpdated": "2026-10-09T10:12:02+02:00"
        },
        "vulnerabilities": {
          "count": 0,
          "ids": []
        },
        "warnings": {},
        "ignoredAdvisories": [
          {
            "id": "RUSTSEC-2023-0089",
            "reason": "atomic-polyfill is unmaintained (heapless ← postcard's default heapless-cas ← iroh-blobs and iroh-tickets; heapless takes it only on AVR and on the riscv32i-unknown-none-elf, riscv32imc-unknown-none-elf, thumbv6m-none-eabi and xtensa-esp32s2-none-elf targets, so no target this repository builds compiles it)"
          },
          {
            "id": "RUSTSEC-2024-0436",
            "reason": "paste is no longer maintained (netlink-packet-core ← netdev/netwatch ← iroh)"
          },
          {
            "id": "RUSTSEC-2024-0370",
            "reason": "proc-macro-error is unmaintained, a build-time macro in both lockfiles (the agent's: genawaiter-proc-macro ← genawaiter ← bao-tree/iroh-blobs; the tray's: glib-macros and gtk3-macros, the Linux GTK stack's, shipped since sequence 42)"
          },
          {
            "id": "RUSTSEC-2025-0081",
            "reason": "unic-char-property is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0075",
            "reason": "unic-char-range is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0080",
            "reason": "unic-common is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0100",
            "reason": "unic-ucd-ident is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2025-0098",
            "reason": "unic-ucd-version is unmaintained (urlpattern ← tauri-utils ← tauri)"
          },
          {
            "id": "RUSTSEC-2024-0429",
            "reason": "glib 0.18 VariantStrIter unsoundness (gtk/gdk/gio/webkit2gtk ← tauri and tauri-runtime-wry, and libappindicator ← tray-icon; compiled into the Linux tray, shipped since sequence 42; the tray's own code calls no glib; it leaves when Tauri's GTK stack moves)"
          }
        ],
        "exitStatus": 0
      },
      {
        "name": "pnpm audit --prod",
        "version": "10.33.0",
        "vulnerabilities": {
          "info": 0,
          "low": 4,
          "moderate": 9,
          "high": 8,
          "critical": 0
        },
        "advisories": [
          {
            "id": "1239932",
            "module": "undici",
            "severity": "moderate",
            "title": "undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression"
          },
          {
            "id": "1240035",
            "module": "undici",
            "severity": "moderate",
            "title": "undici vulnerable to Denial of Service via orphaned RetryHandler response body"
          },
          {
            "id": "1240037",
            "module": "undici",
            "severity": "low",
            "title": "undici vulnerable to downstream response splitting via retry interceptor"
          },
          {
            "id": "1240040",
            "module": "undici",
            "severity": "high",
            "title": "undici vulnerable to Denial of Service via unrequested WebSocket subprotocol"
          },
          {
            "id": "1240043",
            "module": "undici",
            "severity": "moderate",
            "title": "undici vulnerable to Denial of Service via unbounded decompression of compressed responses"
          },
          {
            "id": "1240045",
            "module": "undici",
            "severity": "moderate",
            "title": "undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches"
          },
          {
            "id": "1240047",
            "module": "undici",
            "severity": "low",
            "title": "undici vulnerable to response truncation via oversized chunked responses in the dump interceptor"
          },
          {
            "id": "1240049",
            "module": "undici",
            "severity": "high",
            "title": "undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool"
          },
          {
            "id": "1240051",
            "module": "undici",
            "severity": "low",
            "title": "undici vulnerable to caching and replay of unsafe HTTP method responses"
          },
          {
            "id": "1240053",
            "module": "undici",
            "severity": "high",
            "title": "undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors"
          },
          {
            "id": "1240054",
            "module": "undici",
            "severity": "moderate",
            "title": "undici vulnerable to Denial of Service via WebSocketStream unclean close"
          },
          {
            "id": "1240090",
            "module": "fast-uri",
            "severity": "moderate",
            "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets"
          },
          {
            "id": "1240091",
            "module": "fast-uri",
            "severity": "moderate",
            "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets"
          },
          {
            "id": "1240093",
            "module": "fast-uri",
            "severity": "moderate",
            "title": "fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization"
          },
          {
            "id": "1240622",
            "module": "@grpc/grpc-js",
            "severity": "high",
            "title": "@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized"
          },
          {
            "id": "1240624",
            "module": "@grpc/grpc-js",
            "severity": "low",
            "title": "@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages"
          },
          {
            "id": "1240639",
            "module": "fastify",
            "severity": "moderate",
            "title": "fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses"
          },
          {
            "id": "1240641",
            "module": "fastify",
            "severity": "high",
            "title": "fastify vulnerable to request body replacement via an async validation result collision"
          },
          {
            "id": "1240642",
            "module": "fastify",
            "severity": "high",
            "title": "fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers"
          },
          {
            "id": "1240643",
            "module": "fastify",
            "severity": "high",
            "title": "fastify vulnerable to request validation bypass via skipped boolean false schemas"
          },
          {
            "id": "1240644",
            "module": "fastify",
            "severity": "high",
            "title": "fastify vulnerable to header validation bypass via incomplete schema case normalization"
          }
        ],
        "reached": true,
        "exitStatus": 1
      }
    ],
    "limit": "Counts of known advisories against the dependency inventory on this day; not a statement about the binaries' behaviour."
  },
  "limits": {
    "integrityVerifiable": true,
    "provenanceVerifiable": true,
    "maliceAbsenceCertifiable": false,
    "reproducibleBuildByteIdentical": false,
    "sourceAuditPerformed": false,
    "openSource": false,
    "windowsAuthenticodeSigned": false,
    "linuxProductionRootCeremony": false,
    "limitStatement": "Integrity and provenance are verifiable: this file is byte-for-byte what was published, by whom, when, with what dependencies. Absence of malice is not certifiable from a binary — by an agent or anyone. Source audit and open-sourcing are separate owner decisions, listed here as not done."
  }
}