Skip to content

VersionSec 0.7.1

Latest
Latest

Choose a tag to compare

View all tags
@dzeusking-dev dzeusking-dev released this 11 Sep 19:34
· 7 commits to main since this release
v0.7.1
09bac1f

VersionSec 0.7.1 supersedes 0.7.0. 0.7.0 shipped with a defect in the command-line version flag; this patch fixes it and adds the tests that should have caught it.

Fixed

  • versionsec --version exited with code 2 and Error: No such option: --version. It now exits 0 and prints VersionSec 0.7.1.
  • forgeguard --version had the same defect. It now exits 0 and prints VersionSec 0.7.1 (forgeguard compatibility CLI) - identifying itself as the compatibility entrypoint without presenting ForgeGuard as the current brand.

Only the version flag was affected. Live scanning, offline configuration review and offline runner review behaved correctly in 0.7.0.

Added

  • tests/test_release_contract.py: every documented command now runs as a real subprocess against an installed console script, in the source environment and in clean virtual environments built from the wheel and from the sdist. The 0.7.0 defect existed because the suite asserted __version__ and drove the CLI in-process, which cannot observe a missing option on an installed entrypoint.

Unchanged on purpose

  • Stable FG-* finding identifiers.
  • Machine-readable schema identifiers (forgeguard.assessment.v1, forgeguard.config-snapshot.v1, forgeguard.runner-snapshot.v1, forgeguard.scan-result.v0.3). These are contract identity, not branding, and no contract changed.
  • v0.5.0, v0.6.0 and v0.7.0 and all their artifacts remain published and untouched.

Install

python -m pip install versionsec==0.7.1

Existing ForgeGuard users:

python -m pip install forgeguard==0.7.1   # compatibility bridge, installs versionsec==0.7.1

Verification

pytest                  426 passed (23 new release-contract tests), 95% coverage
ruff check / format     clean
build + twine check     PASSED (wheel + sdist)
clean venv from wheel   all 10 contract commands rc=0, pip check clean
clean venv from sdist   identical

The attached wheel and sdist are the exact artifacts built and attested by CI on 09bac1fbdf4c930f8063f32b6513a766ca537d6d. Verify provenance with:

gh attestation verify versionsec-0.7.1-py3-none-any.whl --repo gexiro-global/versionsec

PyPI

Published. Both distributions are public:

python -m pip install versionsec==0.7.1
python -m pip install forgeguard==0.7.1   # compatibility bridge, pins versionsec==0.7.1

Publication went through Trusted Publishing from this repository's release.yml, promoting the
frozen candidate set rather than rebuilding. The bytes on PyPI are the same bytes attached to
this release:

versionsec-0.7.1-py3-none-any.whl  9289e543a55335f0f77bdaa69950bbf314244f380b7cecb070f6a28fac2d9cc1
versionsec-0.7.1.tar.gz           ab3670a4e46f1b3fdcbf63b8c845b641a44523454335fbc66195f21e8bd8cd14

The compatibility bridge is metadata-only and is published separately by release-bridge.yml,
which refuses to upload unless the distribution is named forgeguard, depends on exactly
versionsec==0.7.1, ships dist-info only, and finds the canonical release already public.

Releases 0.2.0 through 0.6.0 of forgeguard remain published and unchanged.

(Updated after publication; this release's assets and tag are unchanged.)

Assets 5
Loading