{
  "product": "firecradle",
  "platform": "iso",
  "channel": "dev",
  "version": "1.0.0",
  "file": "firecradle-24.04-amd64.iso",
  "url": "https://cdn.shadowcradle.com/download/firecradle/iso/dev/1.0.0/firecradle-24.04-amd64.iso",
  "sha256": "2e61c73e2b40a5069ca66fb3cd332477bddc20411307788cafa0bbd61d62ec18",
  "sha512": "9ae6f5346cac70df1d941f3bd9c2f59271d74a67517f338671cf2fe9262606d055abed230a4b00bc7142c1269832d94ac4293dc914f873ec83b25c5b06739488",
  "signature": "7c0c9ac6d01a92a15d740ac19a9ce4db40edc1d090f8831a45284ccb85cf3763822a4061178396e457c3a8abab742b5bdccb93867339d005d3ffaea718a75508",
  "signed": true,
  "signature_means": "Ed25519 signature over the artefact bytes. Anyone can verify it against \"signing_key\" \u2014 that is a self-contained check and it is all this field claims. It is an ORIGIN claim only to an appliance that PINS this exact public key: ota_update_service verifies against FIRECRADLE_RELEASE_PUBKEY (or an operator-set key, which wins) and refuses everything when neither is set. Compare \"signing_key\" with what your appliance pins; if they differ, this artefact is refused there. A signature is a claim you can check, not one a fleet has been told to trust.",
  "signing_key": "a2ea774eeec3d4559997e01353cd68a3408e0862a97bffd7ed607ca493fe77c9",
  "size_bytes": 1457573888,
  "release_notes": "Firecradle 1.0.0 dev build from devel 4f27e831: noble-security patch level (kernel 6.8.0-139), 679 packages held, Sentry error reporting.",
  "released_at": "2026-09-11T22:53:40.286471+00:00",
  "kind": "installer-image",
  "installs": "A full Firecradle appliance, from bare metal. This is NOT an over-the-air update: nothing on a running appliance can apply it.",
  "build_manifest_url": "https://cdn.shadowcradle.com/download/firecradle/iso/dev/1.0.0/build-manifest.json",
  "build_manifest_sha256": "3866f26fde94f1f76d86d9655a0f09a69bf2e95ed4f546c75a435cf5a3d36fd1"
}