{
  "checked_on": "2026-10-12",
  "release_url": "https://github.com/ossf/scorecard/releases/tag/v5.5.0",
  "binary_version": "v5.5.0",
  "binary_commit": "c395761df6afe1a69e476bc60a013a94bcbc153f",
  "binary_platform": "linux/amd64",
  "binary_sha256": "e63945e2c94060b4768d86b3ae3878c3b985fbfae3b082603a6fa9c06f28fe86",
  "retrieval": {
    "records": [
      {
        "kind": "archive",
        "url": "https://github.com/ossf/scorecard/releases/download/v5.5.0/scorecard_5.5.0_linux_amd64.tar.gz",
        "file": "scorecard_5.5.0_linux_amd64.tar.gz",
        "retrieved_at": "2026-10-12T17:12:41.185Z",
        "bytes": 26474049,
        "sha256": "83b90a05c1540ef1390db1cd5711e5fd04be9c1d8537fb84d39d02092d6a8dff"
      },
      {
        "kind": "checksums",
        "url": "https://github.com/ossf/scorecard/releases/download/v5.5.0/scorecard_checksums.txt",
        "file": "scorecard_checksums.txt",
        "retrieved_at": "2026-10-12T17:12:39.197Z",
        "bytes": 612,
        "sha256": "0a3cf6e9f7a340b05e66840b1e44322a59be5ab8a55cffdef4b69ae8ca8acc77"
      },
      {
        "kind": "source",
        "url": "https://raw.githubusercontent.com/ossf/scorecard/v5.5.0/checks/pinned_dependencies.go",
        "file": "pinned_dependencies.go",
        "retrieved_at": "2026-10-12T17:12:39.071Z",
        "bytes": 2168,
        "sha256": "8e247de6f8100b6ecec284b6a6efb3a1dd1cb40e0efc1abdfc8e62e3a2540e43"
      },
      {
        "kind": "source",
        "url": "https://raw.githubusercontent.com/ossf/scorecard/v5.5.0/checks/dangerous_workflow.go",
        "file": "dangerous_workflow.go",
        "retrieved_at": "2026-10-12T17:12:39.061Z",
        "bytes": 2128,
        "sha256": "593b6683a6c300fd73e960c9cf8e5eac81294e2b252d7537f1d289a66e4a1a93"
      }
    ],
    "release_API_and_checksum_match": true
  },
  "additional_source_reads": [
    {
      "url": "https://raw.githubusercontent.com/ossf/scorecard/v5.5.0/checks/permissions.go",
      "sha256": "b7ba3d8da3bf41373855da9659303607a4d2c14fdc248a06a395e69f2dd65a39",
      "retrieval_date": "2026-10-12",
      "exact_retrieval_timestamp_not_saved": true
    },
    {
      "url": "https://raw.githubusercontent.com/ossf/scorecard/v5.5.0/checks/evaluation/permissions.go",
      "sha256": "504e8ef33647c2b284257eb290f8e30fa8edca68d6a22db9e42f15a7cd410da3",
      "retrieval_date": "2026-10-12",
      "exact_retrieval_timestamp_not_saved": true
    },
    {
      "url": "https://raw.githubusercontent.com/ossf/scorecard/v5.5.0/checks/evaluation/pinned_dependencies.go",
      "sha256": "2b73c1f7cef3d727b222de2df219a0eb5d7db88c647b9815603126b7a3f9f5c9",
      "retrieval_date": "2026-10-12",
      "exact_retrieval_timestamp_not_saved": true
    },
    {
      "url": "https://raw.githubusercontent.com/ossf/scorecard/v5.5.0/checks/evaluation/dangerous_workflow.go",
      "sha256": "cd1754db3b9ae68384301f6840a0b35fedd15beb8c381c1187d559c6be7ab72f",
      "retrieval_date": "2026-10-12",
      "exact_retrieval_timestamp_not_saved": true
    }
  ],
  "archive_contents": [
    "LICENSE",
    "README.md",
    "scorecard"
  ],
  "archive_included_in_evidence": false,
  "authenticity_limit": "Downloaded from the official release; archive matched both the release API digest and the published checksum. These share the upstream trust source. No attestation/signature validation or reproducible build comparison was performed.",
  "checkout_pin": {
    "reference": "actions/checkout@v4.2.2",
    "commit": "11bd71901bbe5b1630ceea73d27597364c9af683",
    "verified_with": "https://api.github.com/repos/actions/checkout/git/ref/tags/v4.2.2",
    "checked_on": "2026-10-12",
    "action_executed": false
  },
  "setup_observations": [
    {
      "operation": "Docker daemon preflight",
      "outcome": "Unavailable; Docker Desktop was not started. Used already-installed Ubuntu WSL."
    },
    {
      "operation": "unshare --net preflight",
      "outcome": "Operation not permitted; no isolation configuration was changed. Experiment was run without a network namespace."
    },
    {
      "operation": "First concurrent download attempt",
      "outcome": "A guessed token_permissions.go URL returned 404. The process aborted before saving files. Source path was then resolved through the official directory listing as checks/permissions.go; the download batch was repeated and verified. This is a client setup issue, not a Scorecard result."
    }
  ],
  "runtime_scope": "Actual CLI execution with env -i, PATH, nonexistent HOME and LANG. No authentication variables provided, no personal repositories, no GitHub workflow execution, no packet capture."
}