v0.1.0a5
Pre-release
0.1.0a5: the first release whose artefacts carry provenance anybody can verify (#8)
Scorecard's Signed-Releases has been sitting at 0/10 with the mechanism already in place, because the
check reads the assets of releases that exist — and 0.1.0a1 through a4 all predate it. A fix
that cannot be verified is a claim, which is the one thing this repository is not allowed to publish.
So: a version, and it earns one under the policy written a few commits ago — "a capability that is
now reachable in the artefact, where it was not before". What a consumer can do with this release and
could not with the previous four:
gh attestation verify oci://ghcr.io/easybytehub/hullwork:0.1.0a5 -R easybytehub/hullwork
gh attestation verify hullwork-0.1.0a5-py3-none-any.whl -R easybytehub/hullwork
Which answers which commit, which workflow and which runner produced this, signed by GitHub through
OIDC — no key of ours to store, rotate or leak. The bundle is attached to the release as
v0.1.0a5.intoto.jsonl as well, so a tool that reads a release's assets can find it without going
through this repository's API. That second copy is the entire reason the check was scoring zero.
Nothing else changed. This is a release cut to prove a mechanism, which the policy allows exactly once
per mechanism and never for a measurement — that is what edge is for now.
Signed-off-by: Javier Miralles Rancaño 68760931+FlagshipDev@users.noreply.github.com