Skip to content

v2.4.5 — First release via OIDC + SLSA provenance

Choose a tag to compare

View all tags
@alikahwaji alikahwaji released this 19 Apr 02:29
· 209 commits to main since this release
v2.4.5
3896f4f

v2.4.5 — First release published via OIDC + SLSA provenance

Tarball provenance. This is the first release of @devilsdev/rag-pipeline-utils published through GitHub Actions OIDC trusted publishing with --provenance attached. Functionally identical to v2.4.4. Upgrade for the supply-chain signal.

🔐 What's different

The tarball now ships with a SLSA build provenance attestation, signed via Sigstore. That means any consumer can cryptographically verify:

  • Which GitHub repository built this tarball (DevilsDev/rag-pipeline-utils)
  • Which workflow file ran (.github/workflows/release.yml)
  • Which commit SHA the tarball was built from
  • Which runner environment produced it

On the npm package page, look for the provenance badge next to the version.

Verify it yourself

npm install @devilsdev/rag-pipeline-utils@2.4.5
npm audit signatures
# Expected output includes:
#   @devilsdev/rag-pipeline-utils  verified registry signature
#   @devilsdev/rag-pipeline-utils  verified attestations

Why this matters

Before this release, the tarball was published from a local maintainer machine using a long-lived npm access token. That's the typical pattern, but it means:

  • The credential is a standing target — if it leaks, an attacker can publish arbitrary versions
  • There's no cryptographic tie between the source code in git and the bytes on the registry
  • Consumers trust the maintainer's machine as much as they trust the maintainer

With OIDC trusted publishing:

  • No long-lived credential exists — each publish uses a short-lived token minted fresh by GitHub's identity provider
  • npm accepts the token only for this one package, from this one workflow, in this one environment
  • The provenance attestation gives consumers an end-to-end chain from git commit → tarball bytes

📦 Tarball

  • Version: 2.4.5
  • Provenance: ✅ attached
  • No code or docs changes from 2.4.4

Migration

Drop-in upgrade from 2.4.4. Zero API or behavior changes.

npm install @devilsdev/rag-pipeline-utils@2.4.5

Full changelog

CHANGELOG.md → 2.4.5 (infrastructure-only release; see .github/workflows/release.yml for the publish pipeline)

npm: https://www.npmjs.com/package/@devilsdev/rag-pipeline-utils/v/2.4.5

Learn more about npm provenance: https://docs.npmjs.com/generating-provenance-statements

Assets 2
Loading