# Release Pack Checksums

- Algorithm: `SHA-256`
- Generated: `2026-07-23T21:20:08.507053+00:00`
- Files covered: 19

Checksums cover generated release-pack metadata, scanner reports, summaries, policy results and update diffs. Self-referential viewer/export files and ZIP containers are excluded. Source code is not copied into the pack or uploaded by default.

## Files

| File | Category | Size | SHA-256 |
| --- | --- | ---: | --- |
| `README.md` | buyer-evidence | 2287 | `ada3e4c104c6bc7dbee1e19a3d6b1b68b39ff6c4d2b4d4c40fc1c351536d036e` |
| `environment-variables.json` | metadata | 2077 | `a72ca9691b850d3cf9da463e232eea6824ec945e79d105c0ded43da1c5d9e135` |
| `excluded-files.json` | generated-artifact | 627 | `1893424a12169aaf8c54879436e902475a9399ee7260d909c150b71c996c595f` |
| `excluded-files.md` | generated-artifact | 435 | `425ab5aa256ebd078a8d56a877ad6d0800ed52805e4c8288f006eae0004581a8` |
| `external-endpoints.json` | metadata | 1437 | `5267f6a9df586de8f9ea62063b91e5b9ca3295e0a2e19f9dd914f15614eefefd` |
| `files-scanned.json` | metadata | 779 | `d9129c108ef54c96916911af41351397ba291eb53fd7cc25a70e30bf2c9eea3c` |
| `ports.json` | metadata | 122 | `95b9b4d6bd374386f2ab7b70671e7970a91a9eb327ccdfb54066d47da7c3d236` |
| `release-diff.json` | buyer-evidence | 2134 | `f32a70e1bf3e18b5e3b88afde04c659a629b1fd9c380cfc483512aae2865f3d8` |
| `release-diff.md` | buyer-evidence | 1866 | `919d193a74007e32f5fecc28a02ff3876a35d8ad8a70910bc5e2e3f62b6161be` |
| `release-manifest.json` | metadata | 1092 | `2ef25aa50c8dd515ccd07adae729c8de62b79d0d33225c4a9acdfc10d468891c` |
| `sbom/images/telemetry-alpine-3.20.cyclonedx.json` | sbom | 50939 | `395485e26b6c2edb10f37b5d85737a53c90139f4619189ae77556afb8accd365` |
| `sbom/images/worker-python-3.12-slim.cyclonedx.json` | sbom | 938347 | `2dfd90c1f05ea9a51f4ffb2b9e8b52aa0b780f23a0e053391bd89b768def33bb` |
| `sbom/sbom-summary.json` | sbom | 646944 | `20a6c7d7ee0dcecd88d89250e0e00a99f040922f87aa78ccf6fd5971d74e4e70` |
| `sbom/sbom.cyclonedx.json` | sbom | 6545 | `bc0fba562bd925338d417446f04263e16005f54b2ba949ff344e917050c36400` |
| `scan-summary.json` | metadata | 603 | `72761ff251e6122f3364d81cbdae1e9dbf0c0ac32ce2659089cb2565b7c02805` |
| `security/vulnerability-report.json` | vulnerability-reporting | 5687 | `946e8ecc44c03ba3cf0f9d927a31ce4790bbdc293939ee391e2fdc8fe911e4a4` |
| `security/vulnerability-summary.json` | vulnerability-reporting | 247 | `45d32d4437a31ca2baa8d30a8eba65758eb014bb681c6630ebd2b6de65d2a678` |
| `security/vulnerability-summary.md` | vulnerability-reporting | 138 | `b44d9f7e9f6f18b6a17bc267a46bbbc5dacad0e6bf0cf8787b25bb56e4d220e6` |
| `services.json` | metadata | 843 | `7949238a13cec146a62b98b4ed5b5deb6ab23895432b02585a3309485cec44ca` |

## Verify

Run `cscode checksums PACK_PATH --verify` on the received pack to recompute hashes and detect changed or missing files.