UtiliVera Scan 0.5.1 audit

Methodology and immutable artifacts

The independent reviewer compared the frozen product with NAPS2, VueScan, PaperScan, ABBYY FineReader PDF, and Adobe Acrobat Pro across acquisition, cleanup, OCR, page assembly, archival PDF, security, automation, recovery, accessibility, localization, performance, packaging, and professional workflows.

• Complete independent product audit
• 51-test frozen-candidate summary
• All 51 named product tests
• Five public workflow evidence records
• Independent installer audit Round 1
• Builder remediation after Round 1
• Independent installer audit Round 2 — internal engineering PASS
• Current 28-component third-party SBOM
• Current third-party notices
• Current offline license index
• Pinned libtiff 4.6.0 corresponding source
• Reproducible no-JBIG libtiff build recipe
• Two-run no-JBIG build and PE evidence
• Pinned libiconv 1.17 corresponding source
• Pinned libthai 0.1.29 corresponding source
• Installer build evidence
• Install, localization, CLI, and prerequisite evidence
• Deterministic build evidence
• Frozen 202-file package manifest
• Screenshot and video provenance
• Artifact hash manifest

Frozen identities

Application: 347,136 bytes

EA12A7B0D89091907255E3FFC36F2638066EC4BCA33FAC7508E8EA8DAB7B1011

Inno Setup candidate: 102,801,116 bytes

1B41E2AAEF33C226C21CF8F8742C234F78F69ACF67FFBCF8808DB4C2E2A1DDB9

Independent installer Round 2 verified all 202 packaged files, 10/10 deterministic builds, localized install and prerequisite paths, licensing, and the reproducible no-JBIG runtime. Internal installer engineering is PASS. Both identities remain withheld as public downloads while unsigned.

Release rule and 30-day target

The download opens only after both files carry a valid trusted signature, signed checksums are published, and the independent auditor confirms the final installer identity with no P0 or P1. That activation begins Scan's separate continuous 30-day target of 1,000 valid downloads.