attest 0.1.5 / Action v1.0.5

attest 0.1.5 / GitHub Action v1.0.5

This bounded patch restores the public signer's verified trust-material refresh path, publishes a
CLI that consumes that signer exactly, and restores repeatable GitHub-hosted cold-start headroom.
Verification rules, outputs, and failure semantics remain fail closed.

Release contents

• GitHub Action v1.0.5 pins the reviewed multi-platform image manifest
  sha256:6e1656ab5da1d5abc43c0ec36e6f3010f1f52c2528ff0e868eb2f62b5754906a.
• Image 0.1.5 retains digest-pinned python:3.12.14-alpine3.23, exact
  libgcc=15.2.0-r2, libcrypto3=3.5.9-r0, libssl3=3.5.9-r0, and zlib, while building
  unmodified Git 2.52.0 and curl 8.22.0 from hash-locked upstream sources. The retained
  runtime includes only the verified Git HTTP(S) transport and its rediscovered loader closure.
• Locked cryptography==50.0.1, pydantic-core==2.46.5, and
  rfc3161-client==1.0.8 are built from their hash-locked source distributions with removable
  maturin==1.15.0, setuptools==84.0.0, exact Alpine build packages, and the approved size
  flags. Native modules use pinned dynamic system OpenSSL/libgcc; only rpds-py retains a private
  libgcc name, replaced fail closed by a link to the pinned system file. Build tools are absent
  from the runtime image.
• Ambient identity and mandatory online trust acquisition begin concurrently with one bounded
  transient retry each, while the signer context and Rekor submission remain single-path.
• The image build verifies the closed production and staging TUF seed from Sigstore's embedded
  roots. Runtime homes receive only the nine hash-checked non-timestamp cache files and retain
  mandatory live root and timestamp refresh.
• The closed pure-Python runtime bytecode archive uses deterministic DEFLATE level 9 with sorted
  members, fixed timestamps and modes, and in-place imports; it introduces no runtime extraction
  path and leaves the already-deflated standard-library archive unchanged.
• Both deterministic Python archives omit fine-grained traceback end-line and column tables while
  retaining optimisation level zero, assertions, docstrings, source line numbers, checked-hash
  invalidation, and their existing deterministic content contracts.
• The isolated wrapper may invoke the bundled CLI in-process only when the installed console
  script matches its build-generated SHA-256 marker. Any missing, malformed, symlinked, or changed
  script uses the existing sanitized subprocess boundary.
• The sanitized single-threaded Linux Action boundary uses a separately terminable fork child;
  public CLI and library callers and every failed precondition retain the spawn boundary.
• Exact branch workflow_dispatch events validate their closed payload, workflow identity,
  checkout, complete history, and first-parent comparison before using push-equivalent ChangeSet
  coordinates; tags, roots, traversal, incomplete history, and mismatches fail closed.
• The candidate publishes and identity-attests the exact corresponding-source artifact before
  the binary, retains Git/curl licences and SPDX identities, and passes immutable CPE-aware Grype
  scanning with only the exact Windows-only CVE-2026-62960 OpenVEX statement.
• Both linux/amd64 and linux/arm64 execute the complete 22-test real-container contract suite,
  including offline historical signature verification, before release.
• The retained candidate includes clean per-platform scans, SBOM, maximum provenance,
  source/context/manifest digests, and a GitHub-hosted identity-bound attestation. Attempt-1 run
  38529646263 binds source 49139761393b1f18f28f6bc06dfc1ff37166aa1b, context
  sha256:25e8aec09b88f9182e10e096cb4336ef0cc9fbd0ea6f5498ab6dcf61a2c6c78b, manifest
  sha256:6e1656ab5da1d5abc43c0ec36e6f3010f1f52c2528ff0e868eb2f62b5754906a, and public
  corresponding source sha256:0855c9c357f8764b18f288c6b13dd5a0859424f12264fa3140e08680637d0457.
• The exact merged Action and candidate digest must pass three consecutive fresh attempt-1 hosted
  measurements of 20 jobs each. Every individual p95 and the combined 60-sample p95 must remain
  strictly below the 18-second release SLO. The strict 15-second engineering target is retained
  and reported independently for every result.
• attest-sign==0.1.1 is rebuilt from the reviewed source and published through its protected
  PyPI Trusted Publisher environment.
• attest-cli==0.1.4 exact-pins attest-sign==0.1.1; both public distributions are byte-matched
  against locally built wheels and source archives, then clean-installed on Python 3.12 and 3.13.
• No other Python distribution is rebuilt or uploaded. Public versions remain
  attest-core==0.1.0, attest-collect==0.1.0, attest-store==0.1.1, and
  attest-policy==0.1.0.

Immutability and promotion

Product/source tag v0.1.5 and immutable Action tag v1.0.5 resolve to the reviewed release
commit. Existing 0.1.4, v0.1.4, and v1.0.4 image and GitHub records remain unchanged; the
new Python patch versions are additive and immutable. The moving v1 tag stays on v1.0.4 until
the separate protected promotion revalidates the immutable release, production dogfood, public
same-repository proof, malicious-content non-execution, safe fork denial, and all retained
performance evidence.

Use immutable Action tag v1.0.5 or its full release commit SHA until that independent promotion
completes.