{
  "artifacts": [
    {
      "arch": "x86_64",
      "download_url": "https://cdn.shadowcradle.com/download/fc-agent/win/stable/0.1.0/firecradle-agent-setup-0.1.0.exe",
      "file": "firecradle-agent-setup-0.1.0.exe",
      "key_id": "ed25519:e7ebc0abbb5ac77a",
      "platform": "windows",
      "release_document_url": "https://cdn.shadowcradle.com/download/fc-agent/win/stable/0.1.0/firecradle-agent-setup-0.1.0.exe.release.json",
      "sha256": "69765c3cfafd1318af87370b67688f3c1e77378a85f2d03c7378e7655cd50e57",
      "sha256_url": "https://cdn.shadowcradle.com/download/fc-agent/win/stable/0.1.0/firecradle-agent-setup-0.1.0.exe.sha256",
      "signature_url": "https://cdn.shadowcradle.com/download/fc-agent/win/stable/0.1.0/firecradle-agent-setup-0.1.0.exe.sig",
      "size_bytes": 75809102,
      "update_url": "https://cdn.shadowcradle.com/update/fc-agent/win/stable/0.1.0/firecradle-agent-setup-0.1.0.exe"
    }
  ],
  "channel": "stable",
  "notice": "This release is signed: each artefact has a detached Ed25519 signature (.sig) and a signed release document (.release.json) beside its versioned copy, made with release key ed25519:e7ebc0abbb5ac77a. Anyone can verify them; they prove who produced the bytes ONLY to a verifier that already pins this exact key -- an agent built from the firecradle-agent repository, or `tools/sign_release.py verify --pinned` run from a checkout of it. A public key fetched from this bucket proves nothing, which is why none is published here. The signature does not make auto-update work from this bucket: the agent takes its update offer from the cloud broker and verifies the release document the cloud serves, so a device sees this signature only once that document is registered with the cloud. The published SHA-256 proves only that a download was not corrupted.",
  "platform": "windows",
  "platform_slug": "win",
  "product": "fc-agent",
  "published_at": "2026-09-11T10:04:11Z",
  "signed": true,
  "version": "0.1.0"
}