ODRE PQC 0.3.1 RC1 Windows verification and trust model
Current authority: Product 0.3.1 RC1 · Release 64 · Closure g270 · official supported OS 6/6 PASS.
Windows Server 2022 status
SUPPORTED · VERIFIED · PASS
Windows Server 2022 AMD64 is one of six verified operating systems. This result is separate from Public Authenticode.
Official release verification model
Release pin → CMS signing authority → signed CRL → independent verifier → signed outer inventory and authenticated Product envelope → manifest/SHA. Any failed check stops installation.
Independent verification procedure
- Obtain Release 64 hashes and pins through an independently authenticated official channel.
- Verify the Customer Delivery filename and SHA-256 before running product code.
- Verify detached CMS and signed CRL with the pinned root and signer. Do not import the private root into Windows Trusted Root.
- Verify signed OUTER_INVENTORY, Product envelope, Product SHA-256, inner Ed25519 manifests, runtime inventory and sealed Core identity.
- Install only after every gate passes; preserve identity, License, Unit, Lease and Gateway state.
Release 64 / g270 authority
| Customer Delivery | ODRE_PQC_0.3.1_RC1_CUSTOMER_DELIVERY_RELEASE64.zip |
|---|---|
| Customer SHA-256 | CF2EBDC5CF967B27498F5162CB1D9C38015361470829AEA15AFD0C5AF5862028 |
| Bytes | 135001552 |
| Product SHA-256 | 935B367591AACAD82F19619E4352EEBC191987A35A3D0DCD48BDC8409F4DE944 |
| install-release-pins.json SHA-256 | 79BB860A169E04E84A64A9568E2012B764F42B4896E0655BBC797EF144DC9F3C |
| CMS signer SHA-256 | 1A69F04F3F5CF88230D48E56D6571EBAE0678FAF49E682FFFB0F5FB5EFE63329 |
| Sealed Core SHA-256 | 6D793B638B7054F7DD6B95A6CFBD2177F653EBB3FB2762D2FF89FAFB8C47162E |
Windows Public Authenticode context
Public Authenticode is not the release trust authority and must not be confused with Windows Server 2022 support or the 6/6 validation result. Do not weaken Windows security controls.
Evidence boundary and future publication binding
Release 64 CMS binds the signed outer file inventory and inner Product envelope. g270 SHA256SUMS records the final Customer Delivery ZIP hash, but Release 64 has no Signed Publication Manifest binding the final outer ZIP container bytes. Do not claim otherwise. Starting with a future new Release, the approved design will bind filename, size, SHA-256, Release and Closure under the same signing authority. Release 64 evidence is not rewritten retroactively. The 6/6 result is product evidence, not third-party certification.
Download current release · Download SHA-256 · Open device registration and Unit transfer guide