# UtiliVera Scan installer remediation — Round 1

Date: 2026-08-20  
Scope: findings from `installer-independent-audit-round-1.md` and the independent legal/PE precheck.

## Findings addressed

1. Replaced the generic third-party notice with a 28-component SBOM whose 174
   packaged third-party files resolve uniquely to version, source revision,
   binary provenance, copyright, license ID, and pinned offline license text.
2. Added 15 complete SPDX 3.27.0 license texts and retained upstream component
   notices. The strict gate reports no unmapped or multiply mapped files.
3. Added complete corresponding source archives for the independently
   replaceable LGPL libiconv and libthai DLLs.
4. Removed the incompatible `Tesseract -> libtiff -> GPL-2.0-only JBIG` import
   chain. `libtiff-6.dll` is now a reproducible libtiff 4.6.0 UCRT64 build with
   `jbig=OFF`; exact source, build recipe, options, output identity, and import
   list ship offline. `libjbig-0.dll` and its GPL source/license entry are not
   in the frozen package.
5. Added a release gate that scans all packaged EXE/DLL files and rejects any
   `libjbig` import or `jbg_dec`/`jbg_enc` symbol.

## Frozen remediation candidate

- Main EXE: 347,136 bytes
- Main EXE SHA-256: `EA12A7B0D89091907255E3FFC36F2638066EC4BCA33FAC7508E8EA8DAB7B1011`
- Package files: 202
- Custom libtiff SHA-256: `C8DB0929714C40B4CD7C5BF9B0DFF8896A4440417B8267699235F09CEA6D201A` (2 clean builds, 1 unique hash)
- Installer: 102,801,116 bytes
- Installer SHA-256: `1B41E2AAEF33C226C21CF8F8742C234F78F69ACF67FFBCF8808DB4C2E2A1DDB9`
- Signing: `NotSigned`; public release remains blocked.

## Verification completed before resubmission

- Product suite: 51/51 PASS after the libtiff replacement, including ten OCR
  languages, PDF/PDF-A behavior, 100-page export, 500-file rollback, 50-round
  concurrent export, and 300/600-DPI performance.
- Legal/SBOM gate: PASS; 174 mapped, 0 unmapped, 0 multiple, 28 components,
  15 full license texts, 3 source archives, 22 notice/license files.
- PE no-JBIG gate: PASS; 32 EXE/DLL files scanned, 0 forbidden matches.
- Installer functional test: PASS for silent install, CLI enumeration,
  same-version repair, silent uninstall, residue checks, ten installer
  languages, ten localized .NET 4.8 negative gates, and installed offline
  license/source evidence.
- The required ten-build deterministic stability result is recorded separately
  in `installer-build-stability-0.5.1.json`.