update-set.json (fresh download 06:31Z): metadata_json version=108 product_version=0.72.0 channel=stable key_id=rel-primary-2026
x86_64-pc-windows-msvc spt-x86_64-windows.exe sha256 47eaabd669fe406c582f0c656fd13ddfd0ccea3ebf50bdef18abb9e1ceebe459 MATCH ipc=1 abi=1
x86_64-unknown-linux-gnu spt-x86_64-linux sha256 b0747dbd20b3bef52962858302cd045a9433341283ea7ffb59e3b5baa13fa61f MATCH ipc=1 abi=1
x86_64-unknown-linux-musl spt-x86_64-linux-musl sha256 95c09671f5c859b81e8649ede0319fce08d66125c6d69c58d0f78423b776a7ae MATCH ipc=1 abi=1
docs spt-docs.tar.gz sha256 MATCH (2674851 bytes)
SHA256SUMS: 3/3 OK (sha256sum -c on fresh downloads)
Armed anchor row release_verify_e2e (SPT_RELEASE_E2E=1, tag v0.72.0): 1 passed in 2.88s (not 0.00s), linux + windows release.json VERIFIED via gh carrier version 108 key rel-primary-2026 (release-verify-e2e.log).
Signature: independent Ed25519 check with OpenSSL 3.1.4 pkeyutl -rawin over metadata_json (835 bytes) with signature_hex (64 bytes) against key 54188f127f9c361090c90f85ac072e623d7001b311d25eca0dd5f57ad05e3ec9 (rel-primary-2026): "Signature Verified Successfully" rc=0; tamper control (1 byte appended) -> "Signature Verification Failure" rc=1.