attest 0.1.8 / Action v1.0.8

attest 0.1.8 / GitHub Action v1.0.8

This is a bounded Action-image security release. It replaces two dependency versions affected by
newly published advisories while preserving the public CLI and every existing Python distribution.

Security correction

• The locked runtime dependency dnspython is upgraded from 2.8.0 to dnspython 2.9.0, the
  first version containing the upstream fix for CVE-2026-114605 / GHSA-45c3-73f7-pv4m.
• The development-only audit dependency msgpack is upgraded from 1.2.2 to msgpack 1.2.3,
  the first version containing the upstream fix for CVE-2026-114613 / GHSA-j586-36cw-2gc2.
• The released container includes dnspython==2.9.0. It excludes msgpack,
  virtualenv 21.14.13, and python-discovery 1.6.4 because those packages are not runtime
  dependencies.
• The existing certificate floor remains enforced at certifi 2026.10.19.

No Python distribution is built or uploaded by this release. The release contract records
"pythonDistributionsPublished": [] and verifies the unchanged public set on Python 3.12 and
3.13, including attest-sign==0.1.1 and attest-cli==0.1.5.

Reviewed candidate

• Candidate workflow run: 40674146751 (attempt 1)
• Candidate source commit: 905c30679d291bce13ad3140703162cf3405e55b
• Enumerated context digest:
  sha256:8b863e6dc4733bb7050b27f34863b3db87db7ff069562ce348a98db0642c17bd
• Multi-platform image digest:
  sha256:1b40c02bfacaae958a2adf9bfc25485fe0c22794db50c19aa401db530ea36c61
• Corresponding-source artifact digest:
  sha256:7a346ff30f6886f5ab06045b0dfd2be645fd2a9df9a6fdabc1f280562e2ae1af

The candidate passed the complete candidate gate, source publication and attestation, component
scan, amd64 and arm64 image scans, real-container tests on both platforms, SBOM and provenance
validation, and identity-bound GitHub artifact attestation. The runtime continues to use
Git 2.52.0, curl 8.23.0, and musl 1.2.5-r24.

Release gates

Before publication, the exact merged commit must pass three consecutive attempt-1 hosted
performance runs. The release workflow recomputes every result and the combined 60-sample
cold-start gate against the reviewed image digest. It then promotes that manifest without
rebuilding, dogfoods the public CLI, attests every release asset, and publishes immutable
v0.1.8 and v1.0.8 records.

The moving major tag v1 remains on the independently reviewed prior release v1.0.7 until
same-repository execution proof, fork-denial proof, and a separate protected promotion review
complete.

attest 0.1.7 / Action v1.0.7

attest 0.1.7 / GitHub Action v1.0.7

This is a bounded storage-correctness release. It fixes filesystem lock acquisition under
cross-process contention while preserving the storage API, on-disk format, error catalogue,
attestation predicates, policy semantics, and every earlier immutable public record.

Python patch boundary

Only these two Python distributions are built once and published through their separate protected
PyPI Trusted Publishers:

• attest-store==0.1.2 replaces the lock-file check-then-create race with atomic exclusive
  creation and a safe existing-lock fallback while retaining no-follow, regular-descriptor, and
  advisory-lock validation.
• attest-cli==0.1.5 exact-pins attest-store==0.1.2 and otherwise preserves its command and
  dependency contract.

The remaining public internal graph is unchanged: attest-core==0.1.0,
attest-collect==0.1.0, attest-sign==0.1.1, and attest-policy==0.1.0 are neither rebuilt nor
uploaded. attest-export remains unpublished. The machine-readable release contract records
"pythonDistributionsPublished" as exactly attest-store==0.1.2 and attest-cli==0.1.5.

Clean Python 3.12 and 3.13 environments must byte-match both public artifacts, install the exact
six-package graph, execute the CLI, require certifi 2026.10.19 or later, and reject the
development-only virtualenv 21.14.12 and python-discovery 1.6.4 packages from the runtime.

Retained Action security baseline

The new Action image carries the corrected store and CLI bytes without weakening the reviewed
runtime boundary. It retains source-built Git 2.52.0 and curl 8.23.0, exact musl 1.2.5-r24,
the locked certifi 2026.10.19 CA bundle, matching OpenSSL runtime libraries, the minimal
HTTP/1.1-only Git transport, four zstd image layers, and the digest-guarded isolated Python path.

Reviewed candidate

Protected dev candidate run 40114789855, attempt 1, completed every repository, corresponding
source, component, two-platform container, image-scan, SBOM, provenance, and identity-attestation
gate for source commit 62b72c2537176c84bc232f727f223a9ea21ae80b.

• Multi-platform image:
  sha256:14e47087c9e6346c8115ba29eb00a922fcc3da630411058f8f35fee7684bf356
• Enumerated 115-file build context:
  sha256:580c0b7881882817ae7ca65dfe1bbdcd06c5bea77556c8b77ff5b04e11cacc73
• Public identity-attested corresponding-source artifact:
  sha256:7472c920350b428c850a6f18f2e17693431b0e89761ef52498b009b0ea447805
• Linux/amd64 manifest:
  sha256:0b14b2da68d2abce405cf87bf7abf56497cd13707bde1b2da634b83bfe31608f
• Linux/arm64 manifest:
  sha256:40ad43b5cc948eeedb09373e241d0e42448cd04e93e2f33e7365a46c0c136de8

Both architectures passed all 23 real-container contracts. Both image scans reported zero
vulnerabilities. The component scan retained only the existing Git-for-Windows-only
CVE-2026-62960 match covered by the exact approved not-affected OpenVEX statement; curl 8.23.0
was clean. Independent verification reproduced the context digest and validated the exact image,
source, manifests, labels, component policy, and GitHub-hosted workflow identities.

Cancelled run 40086747745 remains immutable incomplete evidence. It passed the pre-build gates
but reached the former 60-minute build ceiling before emitting a binary, so it is not a candidate
and is never reused. Run 40114789855 used the approved 90-minute ceiling without changing an
input, runner class, privilege, or verification gate.

Release gate and compatibility

The exact merged main commit and reviewed image must complete three consecutive attempt-1
20-job performance runs. Each run and the recomputed 60-sample nearest-rank p95 must remain
strictly below the 18-second release SLO; the strict 15-second engineering target is reported
independently.

Only after that evidence passes may the protected release publish the two Python patches, promote
the reviewed manifest without rebuilding to image 0.1.7, create immutable source v0.1.7 and
Action v1.0.7, and complete production dogfood. Moving major tag v1 is a separate reviewed
promotion. It remains on immutable v1.0.6 until the release, same-repository proof, safe fork
denial, public verification, and independent promotion checks all pass.

attest 0.1.6 / Action v1.0.6

attest 0.1.6 / GitHub Action v1.0.6

This is an image-only security release. It replaces vulnerable runtime bytes in the GitHub
Action while preserving every Python package version, public API, input/output contract,
predicate, policy, storage format, and verification rule from v1.0.5.

Security corrections

• The Action now vendors certifi 2026.10.19, which replaces the CA bundle affected by
  GHSA-6q48-6c7w-9gw2.
• The final Alpine runtime contains musl 1.2.5-r24, replacing 1.2.5-r23 affected by
  CVE-2026-107891. Both native build stages use the matching musl development revision.
• The minimal HTTPS transport uses Git 2.52.0 with curl 8.23.0, OpenSSL 3.5.9, and zlib
  1.3.2. curl 8.23.0 replaces 8.22.0 affected by CVE-2026-92392 without enabling HTTP/2,
  HTTP/3, WebSockets, cookies, or another optional transport dependency.
• Development-only virtualenv 21.14.12 and python-discovery 1.6.4 are corrected in the
  repository lock and are absent from the Action runtime and clean public-package installations.

No Python distribution was rebuilt or published. Clean Python 3.12 and 3.13 environments verify
the unchanged public set exactly:

• attest-core==0.1.0
• attest-collect==0.1.0
• attest-sign==0.1.1
• attest-store==0.1.1
• attest-policy==0.1.0
• attest-cli==0.1.4

Those probes require certifi 2026.10.19 or later and reject development-only virtualenv and
python-discovery. The machine-readable release contract and evidence index record
"pythonDistributionsPublished": [].

Reviewed candidate

Protected dev candidate run 39906806331, attempt 1, completed every source, component,
two-platform container, image-scan, SBOM, provenance, and identity-attestation gate for source
commit ae456176d0faefb732b9d8d8a4526365ad559278.

• Multi-platform image:
  sha256:f389b16257feab193532de0ea0b9339bb69255f9ff130f7b594f87ac4a0d10fe
• Enumerated build context:
  sha256:646ac89af1aa583ce3780c8542d980559a6782b171131df017daf35293440df1
• Public identity-attested corresponding-source artifact:
  sha256:535fb5f393bc57d28383cd8f453eac87e196531d44d28e835e54efefcbb22e0a
• Retained curl 8.23.0 archive SHA-256:
  8dadd7d2536a314f982ad05a651b713f426bf7d02cc2c76cffb9796f2218e6c5
• Linux/amd64 manifest:
  sha256:1770f3f63a11bb930c5ced53eebb7a58a158cfde08ed3d49b00d67800e131ed8
• Linux/arm64 manifest:
  sha256:52fe2e0ad06962a1b38db624673d5e2549468a4848bb673e3e25af4bb5128160

Both architectures passed all 23 real-container contracts. Both image scans reported zero
vulnerabilities. The immutable component scan found only the existing Git-for-Windows-only
CVE-2026-62960 match covered by the exact approved not-affected OpenVEX statement; curl 8.23.0
was clean.

Failed run 39829765757 remains immutable negative evidence. Its component gate rejected curl
8.22.0 and retained only the identity-attested source artifact
sha256:5aef5c06c1989411d86c636c38dec652eec7747dccab739decc648ab560c23c4;
it produced no binary candidate and is not reused or rerun.

Release gate and compatibility

The exact merged main commit and reviewed image must complete three consecutive attempt-1
20-job performance runs—one automatic run and two reviewed dispatches—and their recomputed
60-sample nearest-rank p95 must remain strictly below the 18-second release SLO. The strict
15-second engineering target is reported independently.

The release workflow then promotes the reviewed manifest to image 0.1.6 without rebuilding,
creates immutable product/source tag v0.1.6 and immutable Action tag v1.0.6, dogfoods the
unchanged public CLI, and retains complete attestation and release evidence. Moving major tag
v1 is a separate reviewed promotion; it remains on immutable v1.0.5 until release, public
same-repository proof, fork denial, and promotion checks all pass.

attest 0.1.5 / Action v1.0.5

attest 0.1.5 / GitHub Action v1.0.5

This bounded patch restores the public signer's verified trust-material refresh path, publishes a
CLI that consumes that signer exactly, and restores repeatable GitHub-hosted cold-start headroom.
Verification rules, outputs, and failure semantics remain fail closed.

Release contents

• GitHub Action v1.0.5 pins the reviewed multi-platform image manifest
  sha256:6e1656ab5da1d5abc43c0ec36e6f3010f1f52c2528ff0e868eb2f62b5754906a.
• Image 0.1.5 retains digest-pinned python:3.12.14-alpine3.23, exact
  libgcc=15.2.0-r2, libcrypto3=3.5.9-r0, libssl3=3.5.9-r0, and zlib, while building
  unmodified Git 2.52.0 and curl 8.22.0 from hash-locked upstream sources. The retained
  runtime includes only the verified Git HTTP(S) transport and its rediscovered loader closure.
• Locked cryptography==50.0.1, pydantic-core==2.46.5, and
  rfc3161-client==1.0.8 are built from their hash-locked source distributions with removable
  maturin==1.15.0, setuptools==84.0.0, exact Alpine build packages, and the approved size
  flags. Native modules use pinned dynamic system OpenSSL/libgcc; only rpds-py retains a private
  libgcc name, replaced fail closed by a link to the pinned system file. Build tools are absent
  from the runtime image.
• Ambient identity and mandatory online trust acquisition begin concurrently with one bounded
  transient retry each, while the signer context and Rekor submission remain single-path.
• The image build verifies the closed production and staging TUF seed from Sigstore's embedded
  roots. Runtime homes receive only the nine hash-checked non-timestamp cache files and retain
  mandatory live root and timestamp refresh.
• The closed pure-Python runtime bytecode archive uses deterministic DEFLATE level 9 with sorted
  members, fixed timestamps and modes, and in-place imports; it introduces no runtime extraction
  path and leaves the already-deflated standard-library archive unchanged.
• Both deterministic Python archives omit fine-grained traceback end-line and column tables while
  retaining optimisation level zero, assertions, docstrings, source line numbers, checked-hash
  invalidation, and their existing deterministic content contracts.
• The isolated wrapper may invoke the bundled CLI in-process only when the installed console
  script matches its build-generated SHA-256 marker. Any missing, malformed, symlinked, or changed
  script uses the existing sanitized subprocess boundary.
• The sanitized single-threaded Linux Action boundary uses a separately terminable fork child;
  public CLI and library callers and every failed precondition retain the spawn boundary.
• Exact branch workflow_dispatch events validate their closed payload, workflow identity,
  checkout, complete history, and first-parent comparison before using push-equivalent ChangeSet
  coordinates; tags, roots, traversal, incomplete history, and mismatches fail closed.
• The candidate publishes and identity-attests the exact corresponding-source artifact before
  the binary, retains Git/curl licences and SPDX identities, and passes immutable CPE-aware Grype
  scanning with only the exact Windows-only CVE-2026-62960 OpenVEX statement.
• Both linux/amd64 and linux/arm64 execute the complete 22-test real-container contract suite,
  including offline historical signature verification, before release.
• The retained candidate includes clean per-platform scans, SBOM, maximum provenance,
  source/context/manifest digests, and a GitHub-hosted identity-bound attestation. Attempt-1 run
  38529646263 binds source 49139761393b1f18f28f6bc06dfc1ff37166aa1b, context
  sha256:25e8aec09b88f9182e10e096cb4336ef0cc9fbd0ea6f5498ab6dcf61a2c6c78b, manifest
  sha256:6e1656ab5da1d5abc43c0ec36e6f3010f1f52c2528ff0e868eb2f62b5754906a, and public
  corresponding source sha256:0855c9c357f8764b18f288c6b13dd5a0859424f12264fa3140e08680637d0457.
• The exact merged Action and candidate digest must pass three consecutive fresh attempt-1 hosted
  measurements of 20 jobs each. Every individual p95 and the combined 60-sample p95 must remain
  strictly below the 18-second release SLO. The strict 15-second engineering target is retained
  and reported independently for every result.
• attest-sign==0.1.1 is rebuilt from the reviewed source and published through its protected
  PyPI Trusted Publisher environment.
• attest-cli==0.1.4 exact-pins attest-sign==0.1.1; both public distributions are byte-matched
  against locally built wheels and source archives, then clean-installed on Python 3.12 and 3.13.
• No other Python distribution is rebuilt or uploaded. Public versions remain
  attest-core==0.1.0, attest-collect==0.1.0, attest-store==0.1.1, and
  attest-policy==0.1.0.

Immutability and promotion

Product/source tag v0.1.5 and immutable Action tag v1.0.5 resolve to the reviewed release
commit. Existing 0.1.4, v0.1.4, and v1.0.4 image and GitHub records remain unchanged; the
new Python patch versions are additive and immutable. The moving v1 tag stays on v1.0.4 until
the separate protected promotion revalidates the immutable release, production dogfood, public
same-repository proof, malicious-content non-execution, safe fork denial, and all retained
performance evidence.

Use immutable Action tag v1.0.5 or its full release commit SHA until that independent promotion
completes.

attest 0.1.4 / Action v1.0.4

attest 0.1.4 / GitHub Action v1.0.4

This image-only correction reduces GitHub Action cold-start transfer cost while preserving the
released Python package graph and public Action interface.

Changed artifacts

• GitHub Action v1.0.4 pins the reviewed multi-platform image manifest
  sha256:7415834d673915cf7935d43f867fd4b49f032984f4733f411eb88a787fe1f4df.
• Image 0.1.4 uses digest-pinned python:3.12.14-alpine3.23, exact Alpine package
  git=2.52.0-r0, removes unused runtime content, strips native extension symbols, precompiles
  hot modules, archives standard-library code and pure-Python runtime packages, removes duplicate
  bytecode caches, Python-only build/test tooling, unused native libraries, and non-product system
  data, upgrades PyJWT to 2.15.1 and urllib3 to 2.8.0, and publishes both runtime
  manifests with four OCI zstd-compressed layers balanced across Docker's three concurrent
  downloads.
• Locked build and validation tooling upgrades virtualenv to 21.14.1.
• The candidate covers linux/amd64 and linux/arm64, has zero vulnerability and secret
  findings, and retains SBOM, maximum SLSA provenance, closed-context evidence, and an
  identity-bound GitHub artifact attestation.
• Product/source tag and immutable GitHub Release v0.1.4 retain the exact candidate,
  performance, promotion, asset-attestation, and production-dogfood evidence.

No Python distribution is rebuilt or uploaded. The public package versions remain
attest-core==0.1.0, attest-collect==0.1.0, attest-sign==0.1.0,
attest-store==0.1.1, attest-policy==0.1.0, and attest-cli==0.1.3.

Upgrade

Use immutable Action tag v1.0.4 or its full release commit SHA. The moving v1 tag remains on
v1.0.3 until the v1.0.4 public onboarding proof and all retained release evidence verify.

Every earlier Python file, image, source tag, Action tag, and GitHub Release remains immutable.

attest 0.1.3 / Action v1.0.3

attest 0.1.3 / GitHub Action v1.0.3

This corrective release makes durable-store publication deterministic across fresh repositories
that publish attestations for the same ChangeSet Digest.

Changed artifacts

• attest-store==0.1.1 discovers, validates, and imports the bounded remote digest namespace before
  allocating a new immutable reference. It fails closed on unstable, malformed, oversized, or
  conflicting remote state and never overwrites a local reference.
• attest-cli==0.1.3 uses remote discovery before publication and preserves the exact newly created
  bundle in the configured fallback directory when remote import or publication fails.
• GitHub Action v1.0.3 uses the reviewed linux/amd64 and linux/arm64 image at
  sha256:d5a370bff96f3dbe8eca341701060b73b915d9bade981e24a835f62362d2e2e1.
• Product/source tag and immutable GitHub Release v0.1.3 retain package, image, provenance, scan,
  publication, and dogfood evidence.

The core, collect, sign, and policy libraries remain at 0.1.0. CLI 0.1.3 pins those libraries
and store 0.1.1 exactly. The image is promoted from candidate run 35963124568 without rebuilding;
its closed build-context digest is
sha256:947ecc3ee98a9cea0eda2eb0c8ddeb6da6606a2af65fa23308720670f4e835f5.

Upgrade

Install attest-cli==0.1.3 and use immutable Action tag v1.0.3 or the release commit SHA. The
moving v1 tag remains at the first release until the replacement public proof completes against
this release.

Releases v0.1.0, v0.1.1, and v0.1.2, and Action tags v1.0.0, v1.0.1, and v1.0.2, remain
immutable.

attest CLI 0.1.2 / Action v1.0.2

attest CLI 0.1.2 / GitHub Action v1.0.2

This corrective release makes the generated pull-request workflow verify the exact GitHub OIDC
identity that signs a pull_request run and preserves safe verification failures at the Action
boundary.

Changed artifacts

• attest-cli==0.1.2 generates a repository- and workflow-bound
  refs/pull/*/merge identity pattern for pull-request verification.
• GitHub Action v1.0.2 preserves known ERR-VERIFY-* diagnostics from denied runs without
  publishing unverified outputs or summaries.
• The Action runtime is the reviewed linux/amd64 and linux/arm64 image at
  sha256:50ff206da7d26341776c954bb190005f1e6d10369b29fbbbe68619ce8d7ad627.
• Product/source tag and immutable GitHub Release v0.1.2 retain the package, image, provenance,
  scan, publication, and dogfood evidence.

The five Python libraries remain at 0.1.0, and CLI 0.1.2 pins each one exactly. The image is
promoted from candidate run 35886884855 without rebuilding; its closed build-context digest is
sha256:1000bc7cc5402e442536ba6d94630da39433b41bdfcea01ebb9b1dc1b0882944.

Upgrade

Replace Action v1.0.1 with immutable v1.0.2 or the release commit SHA. Existing projects should
rerun attest init only in a clean integration fixture or update both configured signer identities
to the generated refs/pull/*/merge pattern. The moving v1 tag remains unchanged until the
same-repository and fork pull-request proofs complete against this release.

Action v1.0.1 and CLI 0.1.1 remain immutable. Their generated configuration expects a main-branch
workflow identity and therefore cannot verify a bundle signed by the generated pull-request
workflow.

attest CLI 0.1.1 / Action v1.0.1

attest CLI 0.1.1 / GitHub Action v1.0.1

This corrective release fixes the GitHub Action token evaluation boundary discovered by the first
fresh-repository proof.

Changed artifacts

• attest-cli==0.1.1 generates the automatic GITHUB_TOKEN handoff in the caller step environment.
• Immutable Action tag v1.0.1 points to this reviewed source commit.
• Product/source tag and immutable GitHub Release v0.1.1 record the correction and evidence.

The five Python libraries remain at 0.1.0, and CLI 0.1.1 pins each one exactly. The Action still
uses the reviewed public 0.1.0 multi-platform image at
sha256:0e5073cb4f2a9cc484f15aded43b7f0b8ac432a0a8b31fc401b7e361cd0509f3; no image is rebuilt or
republished.

Upgrade

Replace Action v1.0.0 with v1.0.1 or the corrected full commit SHA. The moving v1 tag remains
on the first release until the corrected public same-repository and fork proofs complete.

Action v1.0.0 remains immutable and is known to fail during job setup because its metadata
references the github context outside a supported evaluation boundary.

attest 0.1.0

attest 0.1.0

The first public alpha release of attest provides deterministic ChangeSet Digests, evidence
collection, AI-authorship Statements, keyless Sigstore signing, independent verification, storage
adapters, policy enforcement, a closed CLI, and a digest-pinned multi-platform GitHub Action.

This release publishes exactly six Python distributions: attest-core, attest-collect,
attest-sign, attest-store, attest-policy, and attest-cli. The unfinished attest-export
package is not published. The Action is available through immutable v1.0.0, reviewed moving
major v1, and full commit SHA references; its runtime image remains pinned by manifest digest.

Release assets include exact source and distribution hashes, GitHub artifact attestations, and the
publicly verified attest Bundle produced by the release workflow itself.