Skip to content

Source Read v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@JalenBuildsHub JalenBuildsHub released this 29 Oct 06:00
Immutable release. Only release title and notes can be modified.
v0.2.0
66b6317
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Source Read v0.2.0 adds a safer truthfulness API and a reviewed source-only release pipeline.

Highlights:

  • Adds assess_check() plus is_pass, is_fail, and is_unknown outcome predicates while preserving the lower-level compatibility contract.
  • Makes unreadable or absent required sources explicit UNKNOWN outcomes instead of allowing accidental success.
  • Hardens deterministic source-archive creation against links, hardlinks, reparse points, path aliases, mixed snapshots, partial writes, and hidden ZIP extents.
  • Adds hash-locked, no-index double wheel builds, exact package metadata and RECORD validation, raw local/central/EOCD and DEFLATE-envelope checks, and an isolated runtime install.
  • Expands the protected CI matrix to Python 3.11-3.14 on Linux plus Windows 3.11/3.14 and macOS 3.14.

Release identity:

  • Provider-verified target commit: 66b631729fcfacc7a914bdcfdb5f9811d901d61f
  • Reviewed tree: 6f37e76b5aa6aba7ba1fab7fb5bc6f2d1a9ca5c4
  • Annotated tag object: d1fd523a80e3c975311d97afb5e1c9d923558089
  • Source asset SHA-256: 6cee0ef1816d992a4b6cd5ee9414d3e280495e263011f5e1aae3af946a49a30c
  • Review and authorization record: PR #3
  • Candidate CI: 40825666960
  • Candidate CodeQL: 40825661967
  • Post-merge CI: 40826380169
  • Post-merge CodeQL: 40826379751

The annotated tag is unsigned because no reviewed maintainer signing key is configured. Compensating controls are the provider-verified target commit, protected non-movable v* tag rules with no bypass actor, immutable GitHub Release, and GitHub's signed release-asset attestation.

This release contains only source-read-0.2.0.zip. Wheels remain validation artifacts; no PyPI or other package-registry publication was performed.

Verify the asset after download:

sha256: 6cee0ef1816d992a4b6cd5ee9414d3e280495e263011f5e1aae3af946a49a30c
gh release verify-asset v0.2.0 source-read-0.2.0.zip --repo nymrel/source-read
python scripts/verify_release.py --archive source-read-0.2.0.zip
Assets 4
Loading