Skip to content

shard-core v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@rivendale rivendale released this 26 Jul 18:00
Immutable release. Only release title and notes can be modified.
v0.3.0
b26f088
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

shard-core 0.3.0

Second stable open-source release of shard-core.

Highlights

  • Guided custody-route selection for provider-native workflows, externally
    held SHEN artifacts, and multi-holder SHRD distribution.
  • Vendor-neutral custody patterns for CoinCover, Station70 Bunker and Custom
    Upload, Nemean, peer-to-peer, tri-party, and deliberately nested designs.
  • Read-back verification of written SHRD and SLIP-39 artifacts before the
    guided workflow recommends distribution.
  • Stronger hidden-input, non-empty passphrase, exact-byte preservation, and
    Fordefi-specific routing controls.
  • Clearer trust boundaries between offline shard-core ceremonies and
    provider-required controlled connected environments.

Compatibility

  • SHEN v1 and v2 artifacts remain readable.
  • SHRD v1 and v2 artifacts remain readable.
  • SHEN v2 and SHRD v2 wire bytes are unchanged.
  • Python 3.9 through 3.14 is supported.

Verified source and candidate

  • Commit: b26f0883ea6467ef40524ee0277fcf413a812ac2
  • Git tree: 0cdb2940fe5d6f352ae9016d040ac03314c38f1f
  • Controlled rootless-Podman candidate: PASS
  • Two isolated local builds within the approved boundary: identical
  • Candidate inventory, archive extraction, offline install, pip check,
    import smoke, and CLI version: PASS
  • Synthetic SHRD, Fordefi SHEN, and SLIP-39 recovery smokes: PASS
  • CI and CodeQL for the exact release commit: PASS

The two-build result is reproducibility within the approved local input,
runtime, image, and platform boundary. It is not a claim of independent
reproducibility across unrelated builders.

Primary hashes

  • Controlled wheel:
    b82e89eab9a84b6e5b5e66ef681fb23ae17e26914eb65c46d60c24938e6e2f22
  • Source distribution:
    0b3bf30f2ec222242f750d0924adc1cd31b25caa22491f40f4a26c629b2d59f7
  • Offline bundle archive:
    f7790cc70e7c1c9125648ee2f2c2193ee15a8b700a3fd86fa1e1578d958d361e
  • Top-level checksum file:
    fb47d5780dfd6db4529b68148a25998d234f3bf1af6968fe9146eab003427c85

Verify every downloaded asset with
shard-core-0.3.0-SHA256SUMS.txt. The offline bundle also contains its own
internal SHA256SUMS and VERIFY.md.

Release assets

  • Python wheel and source distribution.
  • Linux x86_64 offline bundle.
  • Top-level SHA-256 inventory.
  • SPDX SBOM.
  • Bundle metadata and provenance.
  • Sanitized build information and smoke evidence.

PyPI publication uses the repository's separate OIDC Trusted Publisher
workflow. Confirm the published files and attestations on the
shard-core PyPI project.

Security status

shard-core has not received an independent professional security audit.
Passing tests, AI-assisted review, reproducible local builds, and smoke
verification are engineering evidence, not a security audit or a guarantee
against loss. Review SECURITY.md, THREAT_MODEL.md, CEREMONY.md, and the
applicable custody runbook before protecting production material.

Assets 12
Loading