Skip to content

docs: record v2.2.0 release provenance - #20

Merged
cdeust merged 1 commit into
mainfrom
agent/openssf-silver-release-evidence
Aug 3, 2026
Merged

docs: record v2.2.0 release provenance#20
cdeust merged 1 commit into
mainfrom
agent/openssf-silver-release-evidence

Conversation

@cdeust

@cdeust cdeust commented Aug 3, 2026

Copy link
Copy Markdown
Owner

Summary

  • mark the OpenSSF signed_releases criterion as met
  • cite the public v2.2.0 release and its GitHub Sigstore provenance
  • retain the separate historical signed-tag criterion as unmet

Verification

  • release workflow completed successfully
  • all three downloaded SHA-256 checksum files verified
  • GitHub attestation API returned the provenance bundle for the exact release digest
  • .bestpractices.json parses successfully
  • git diff --check passes

@cdeust
cdeust merged commit 051ceff into main Aug 3, 2026
3 checks passed
@cdeust
cdeust deleted the agent/openssf-silver-release-evidence branch August 3, 2026 08:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant