UtiliVera Duplicates 0.9.0 audit

Methodology and immutable artifacts

The independent reviewer compared the frozen application with AllDup, Duplicate Cleaner, dupeGuru, Auslogics Duplicate File Finder, and Wise Duplicate Finder across exact proof, approximate-media boundaries, keeper protection, recovery, hard links, reporting, performance, accessibility, localization, packaging, and professional workflows. Claims below link to immutable public files whose hashes are listed in one machine-readable manifest.

• Complete eighth-round independent product audit
• 73-test candidate build and regression summary
• Independent installer audit Round 2
• Installer build and embedded-manifest evidence
• Silent install, CLI, reinstall, uninstall evidence
• Frozen 143-file package manifest
• Screenshot and 42-second video provenance
• Artifact sizes and SHA-256 manifest

Frozen identity

Executable: 353,792 bytes

5F59977C69A25CCCB9569D1ED3F4F2D8043E2336CCFCD4C14933A623C754D727

Portable ZIP: 2,408,368 bytes · SHA-256 FD77C6B4D683744671D6F373C6601A8AA2971F2AE6ECF968A74F50D9A49640D1. The package manifest records every installed relative path, byte size, and SHA-256.

Installer candidate: functional PASS, release BLOCKED

Inno Setup 0.9.0 candidate: 3,951,536 bytes

81654330CE07F634AAF3FD29B742B0E401AF8E5849E4EE13EBF357889DEECA34

All 143 embedded files match the frozen source manifest. Silent installation, in-place reinstall, exact-scan CLI smoke test, silent uninstall, installed legal notices, and removal of the install directory, uninstall registration, and Start menu shortcut pass. User settings and recovery data are deliberately preserved to prevent data loss. The candidate checks for .NET Framework 4.8, but is not Authenticode-signed, has no public download URL, and cannot start the launch clock. Independent installer Round 2 closed every internal P1; the only remaining P1 is trusted code signing for the installer and main EXE.

Product audit result

The final independent product audit recorded P0=0, P1=0, P2=2 and 99/100. The remaining P2 items concern broader multi-frame video similarity and full self-containment of every archive path. That product result does not approve the unsigned installer.

Release rule

The download opens only after the final installer carries a valid trusted signature, the signed checksum is published, and the independent installer auditor confirms no P0 or P1 findings. That activation timestamp starts the separate 30-day 1,000-download clock.