{
  "schemaVersion": 1,
  "evidenceId": "posnic-v1.5.0-beta.624-github-artifact-attestation",
  "evidenceType": "publisher-verified-github-artifact-provenance",
  "canonicalPage": "https://posnic.com/about#release-provenance",
  "reviewedAt": "2026-08-24",
  "repository": "Posnic/POS",
  "release": {
    "tag": "v1.5.0-beta.624",
    "channel": "prerelease",
    "stableRelease": false,
    "publishedAt": "2026-08-24T13:07:22Z",
    "url": "https://github.com/Posnic/POS/releases/tag/v1.5.0-beta.624",
    "checksumUrl": "https://github.com/Posnic/POS/releases/download/v1.5.0-beta.624/SHA256SUMS.txt"
  },
  "attestation": {
    "id": 42583708,
    "url": "https://github.com/Posnic/POS/attestations/42583708",
    "predicateType": "https://slsa.dev/provenance/v1",
    "buildType": "https://actions.github.io/buildtypes/workflow/v1",
    "issuer": "https://token.actions.githubusercontent.com",
    "transparencyLogIndex": 2581000429,
    "transparencyLogUrl": "https://search.sigstore.dev?logIndex=2581000429",
    "subjectCount": 8,
    "installablePackageSubjectCount": 8,
    "buildMetadataSubjectCount": 0
  },
  "build": {
    "workflow": ".github/workflows/beta.yml",
    "workflowUrl": "https://github.com/Posnic/POS/blob/eee9d4c502b83df56ea677262867f7fe5f7411eb/.github/workflows/beta.yml",
    "workflowRun": 32729980125,
    "workflowRunAttempt": 1,
    "workflowRunUrl": "https://github.com/Posnic/POS/actions/runs/32729980125",
    "event": "push",
    "ref": "refs/heads/main",
    "commit": "eee9d4c502b83df56ea677262867f7fe5f7411eb",
    "runnerEnvironment": "github-hosted",
    "attestationCompletedBeforeReleasePublication": true
  },
  "subjects": [
    {
      "filename": "Posnic-1.5.0-beta.624-linux-x86_64.AppImage",
      "kind": "installable-package",
      "operatingSystem": "linux",
      "architecture": "x86_64",
      "sha256": "7f1bc6c027a310e4671c2f5b54f5be151a37b329287e0df795dfddfc352c8b69"
    },
    {
      "filename": "Posnic-1.5.0-beta.624-macos-arm64.dmg",
      "kind": "installable-package",
      "operatingSystem": "macos",
      "architecture": "arm64",
      "sha256": "c3f0654308b60c5fe0c2ff1fd6f5af342866fa7e77f977d12d90d712a5db5610"
    },
    {
      "filename": "Posnic-1.5.0-beta.624-macos-arm64.zip",
      "kind": "installable-package",
      "operatingSystem": "macos",
      "architecture": "arm64",
      "sha256": "e794e2337bf7aaced0abf54a8b49ffa628990c31b044ea3fca24c268deb03b9a"
    },
    {
      "filename": "Posnic-1.5.0-beta.624-macos-x64.dmg",
      "kind": "installable-package",
      "operatingSystem": "macos",
      "architecture": "x64",
      "sha256": "e6a26da9183016f84675d839902824f8b5d019ab86707073d5741bf956093003"
    },
    {
      "filename": "Posnic-1.5.0-beta.624-macos-x64.zip",
      "kind": "installable-package",
      "operatingSystem": "macos",
      "architecture": "x64",
      "sha256": "09c6b9b7f2e2bb0056bb31a7b016ca5a0722a87352778f883e9129ed7be80348"
    },
    {
      "filename": "Posnic-1.5.0-beta.624-windows-x64-installer.exe",
      "kind": "installable-package",
      "operatingSystem": "windows",
      "architecture": "x64",
      "sha256": "2b49057c437791879a9f88557cc459d5062d3e60ba1b0282582688f3852c09b7"
    },
    {
      "filename": "Posnic-1.5.0-beta.624-windows-x64-portable.exe",
      "kind": "installable-package",
      "operatingSystem": "windows",
      "architecture": "x64",
      "sha256": "c4195cc0377b54b292cc64c40ba9465df89fb141fc624b499706e1652c7d3db2"
    },
    {
      "filename": "posnic_1.5.0-beta.624_amd64.deb",
      "kind": "installable-package",
      "operatingSystem": "linux",
      "architecture": "amd64",
      "sha256": "5a9ee676eb442e17abaef5f05f3d124958d67abd23b33d6e247d161572661b52"
    }
  ],
  "publisherVerification": {
    "result": "pass",
    "method": "Download one released package, compare its local SHA-256 with the GitHub release digest, then run gh attestation verify against Posnic/POS.",
    "verifiedAt": "2026-08-24",
    "tool": "GitHub CLI",
    "toolVersion": "2.97.0",
    "repositoryArgument": "Posnic/POS",
    "sample": {
      "filename": "Posnic-1.5.0-beta.624-windows-x64-installer.exe",
      "bytes": 167179311,
      "localSha256": "2b49057c437791879a9f88557cc459d5062d3e60ba1b0282582688f3852c09b7",
      "githubReleaseSha256": "2b49057c437791879a9f88557cc459d5062d3e60ba1b0282582688f3852c09b7",
      "attestationVerification": "pass"
    }
  },
  "stableChannelBoundary": {
    "stableTag": "v1.3.0",
    "hasGitHubArtifactAttestation": false,
    "reason": "The stable release predates the current GitHub artifact-attestation workflow.",
    "verificationPage": "https://posnic.com/download"
  },
  "limitations": [
    "This is publisher-run verification of a prerelease pipeline, not an independent review or endorsement.",
    "The attestation binds subjects to the named repository, workflow, ref, commit and run; it is not code signing or notarization.",
    "The attestation does not prove source review, vulnerability absence, reproducible builds, security, legal compliance, adoption or suitability for a particular shop.",
    "Only the named Windows installer was downloaded and independently hashed during this publisher verification; the other subject digests were read from the attested checksum statement and GitHub release metadata.",
    "The public release also contains updater manifests and blockmaps, but the checksum list and attestation contain only the eight installable packages.",
    "Stable v1.3.0 has no GitHub artifact attestation and must continue to be checked against its published SHA256SUMS.txt file and signing limitations."
  ]
}