WolfSDKWolfXLWolfPPTWolfDocx

Procurement evidence

Buyer security pack

Review wolf-v0.2.0 release artifacts, the 2026-10-12 dependency scan, and the WolfXL data-handling statement in one place.

Download the review packet

Advisory packetData-handling statementSBOM and provenance by platform

For the recorded scan, the root workspace lock has 0 critical or high findings and the published release SBOMs have 0. The candidate-bundle wheels have 12 open high rows, the Community package lock has 4, and optional Python extras have 1. Review the affected artifacts before deployment.

These are separate artifact populations. The release-binary result does not establish a clean scan for Python wheels, the Community package, or optional dependencies.

Release SBOMs and signed provenance

Choose the platform matching your binary. Download the CycloneDX SBOM, SLSA provenance predicate, and original Sigstore bundle.

wolf-aarch64-apple-darwin

SBOM (CycloneDX)ProvenanceSigstore bundle

Binary SHA-256: e510fd17af21bd547dbaab67475b731a19f4dcb8da514b6ff3caa9416d39ecec

Buyer download SHA-256 checksums
  • wolf-aarch64-apple-darwin.cdx.json: 623facb3d771bb49afba045ca2bb988db2cc34e737320eb44afa2f0d23eaa70c
  • wolf-aarch64-apple-darwin.provenance.json: 873e89fd36fd58ad03fadea3cd537c0993e187ef9b29dd71a6de589d81072137
  • wolf-aarch64-apple-darwin.sigstore.json: 6b3ed4901c06050f079f7762f945faedb3b1db6e8b84646eb9a7f6e41dd7a2ec

wolf-aarch64-unknown-linux-musl

SBOM (CycloneDX)ProvenanceSigstore bundle

Binary SHA-256: e448cadaa49b8c2a2ae3846fc986a73ed5f7a069ea51a668978ffef01e023a70

Buyer download SHA-256 checksums
  • wolf-aarch64-unknown-linux-musl.cdx.json: 7c54a851c1cc821f1aa73b4119d2bf7864ac4e95d515aa1230b9dc6f4e7ff7e7
  • wolf-aarch64-unknown-linux-musl.provenance.json: f837672d6486d4b8ffdda57bef0787c682f3ca6c8cae4e3a1586dd77060f1a52
  • wolf-aarch64-unknown-linux-musl.sigstore.json: 6249ad9ef789cd92ce8330547b4d8f8e98fd71910ad7a0a9e3450fd9781892a0

wolf-x86_64-apple-darwin

SBOM (CycloneDX)ProvenanceSigstore bundle

Binary SHA-256: 12d468ed6c97a29b950fadc9a9fb56f2599d633173a13418e9ff1e940b3a7725

Buyer download SHA-256 checksums
  • wolf-x86_64-apple-darwin.cdx.json: 1f9fd0b60c24b0263738effd9898fe4c28efd8166835178f4ab8e9816b61f9d0
  • wolf-x86_64-apple-darwin.provenance.json: bd9617a8d620541520152ceed54b706ddd443f99c19d2397e0d64f707c723462
  • wolf-x86_64-apple-darwin.sigstore.json: e9f9293ccb63cb63e17d57d3be63ca6d77697255719aeed52efbf8e84bd04dc0

wolf-x86_64-pc-windows-msvc.exe

SBOM (CycloneDX)ProvenanceSigstore bundle

Binary SHA-256: bcb6764ba4f55ef117ab372b33116779416d00e6fbd281e6e23e13cc84bdad02

Buyer download SHA-256 checksums
  • wolf-x86_64-pc-windows-msvc.exe.cdx.json: 0ad00e0ac0cf2b50d013df68f1aa03e1033fc1893e8693c5d6886807b00bf338
  • wolf-x86_64-pc-windows-msvc.exe.provenance.json: 2547c0d43e710654b04efe7212e631d31b9396a8b34032dc3f8b77485996c108
  • wolf-x86_64-pc-windows-msvc.exe.sigstore.json: 45cae5891dde68460d647e8bd8b05b0da62eb19729718d455fa2f04cd7356390

wolf-x86_64-unknown-linux-musl

SBOM (CycloneDX)ProvenanceSigstore bundle

Binary SHA-256: 4271ab09784c4fba174859d6b4ccd718e8c345104a336c5703a2c6eb01b2ea1b

Buyer download SHA-256 checksums
  • wolf-x86_64-unknown-linux-musl.cdx.json: 7829494f1d5608db50df22dd7890acc7d0754a7cc1b95a7da82c3341f94c9bc4
  • wolf-x86_64-unknown-linux-musl.provenance.json: 8809522825c0d403f95bd9e33910088bdec8e408eddd4dc3302d4a8b8de06646
  • wolf-x86_64-unknown-linux-musl.sigstore.json: be346c1171f22ac094d543cd55f18cb5dc1ee2b6d7be0982eb164f43b79d0547

SBOM copies retain the release component inventory with build-machine paths replaced by repository-relative identifiers. Their digests differ from the original release SBOMs. Provenance and Sigstore bundles are byte-identical to the release. Use the displayed buyer digests for SBOM copies and the original release SHA256SUMS for original artifacts.

To verify your release binary, download its Sigstore bundle and the signing public key, then run:

cosign verify-blob-attestation --key cosign.pub --type slsaprovenance1 \
  --bundle wolf-x86_64-unknown-linux-musl.sigstore.json \
  --insecure-ignore-tlog=true wolf-x86_64-unknown-linux-musl

Substitute the artifact name for your platform. Verification uses the committed signing key without a transparency-log check. The producer recorded successful digest and signature verification for all five binaries.

Advisory scan scope

The advisory database was dated 2026-10-12. The scan source is 136be32dbb25de23ff55642947fd5ce4eb3a9f82. Download every retained finding, tool version, dependency-lock digest, severity, and reachability note in the advisory packet.

The 16 Rust high rows remain open regardless of reachability attribution. Optional Python dependencies include a separately counted high finding and unrated findings. Findings on development-only or unshipped locks are retained with their scope.

A clean result applies to the recorded artifact and advisory database. This page does not certify later builds or dependencies installed outside that closure.

Data handling

  • The WolfXL runtime does not upload workbooks or workbook contents.
  • The library has no usage telemetry, activation call, heartbeat, or advertising tracker.
  • Network access is required when the package manager installs WolfXL from the authenticated index.
  • Stripe processes self-service payments. WolfXL does not receive or store full payment-card numbers.
  • Purchase records retain the customer identity, intended use, server-derived seat count, checkout identifiers, agreement and authority evidence, fulfillment status, and acquisition attribution described in the privacy policy.

Runtime handling and website handling have different boundaries. Review the privacy policy for website analytics, purchases, evaluations, and package-service records, and the vendor information for deployment and licensing.

Download the committed data-handling statement.

Evidence identity

Security evidence commit: 9803ec5d63b29f1f6e5f42dc95f2789c7fe348a0. Data-handling source commit: 7198a00f34c2e3b7639fb4434ae4840dce5228d1.

The downloads are generated from frozen evidence and release artifacts. Source paths and SHA-256 digests are included in the JSON downloads. No repository login is required to review this pack.