Skip to content

GOVP 0.1.8 — first stable public protocol release

Choose a tag to compare

View all tags
@enekosz enekosz released this 04 Aug 21:29
Immutable release. Only release title and notes can be modified.
v0.1.8
c25516f

GOVP 0.1.8 — first stable public protocol release

Sign once. Verify anywhere.

GOVP is an open protocol for portable, independently verifiable digital
artifacts. A GOVP record binds an artifact identity and SHA-256 digest to an
Ed25519 signature without requiring a GOVP account, central API or hosted
verification service.

Why this release matters

  • freezes the GOVP-1 wire format and its byte-exact signing rules;
  • ships the normative specification, JSON Schema and conformance vectors;
  • provides the Python reference verifier and command-line interface;
  • verifies locally and works without a central service;
  • uses synthetic examples and contains no product, tenant or operational data;
  • is licensed under Apache-2.0, with separate GOVP and Gemacode trademark
    boundaries.

Audited source

This release points to the exact clean-root commit reviewed for publication:

commit  c25516f471ed38f4b28a23b8eaa9af490a8f7f8b
tree    ea8f08bc83465edddf2707a25963becd9237d084
archive 501853028dd51ba37b67459690230f089b87dc3b6fd6e61e577aa79a32306f56

The independent AI-assisted re-audit result supplied by the project owner was
approved for publication for that exact archive digest. The review noted
two non-blocking operational points: privately issued 0.1.x records containing
raw non-ASCII URL text may require migration to URI-ASCII, and consumers
should bind provenance to the archive hash and source commit.

The developer-facing README and community files were improved after the audit
on main. They do not change the specification, schema or conformance
vectors. The release tag intentionally remains attached to the audited commit.

Install and verify

python -m venv .venv
. .venv/bin/activate
python -m pip install govp-0.1.8-py3-none-any.whl
govp self-test

Or install directly from the immutable tag:

pipx install git+https://github.com/govp-protocol/govp.git@v0.1.8
govp self-test

See VERIFY-RELEASE.md and RELEASE-MANIFEST-v0.1.8.json in the release
assets for provenance and exact verification commands.

Integrity

This is an immutable GitHub release. After publication, GitHub locks the tag
and assets and generates a cryptographically verifiable release attestation.

gh release verify v0.1.8 --repo govp-protocol/govp

GOVP proves that the declared key signed the exact record and, when artifact
bytes are supplied, that the digest matches. GOVP does not prove that a
statement is true or that an event occurred.

Assets 14
Loading