surfaceplate 0.18.0 is on PyPI: https://pypi.org/project/surfaceplate/0.18.0/
pip install surfaceplate==0.18.0
pip install 'surfaceplate[adopt]==0.18.0' # the adoption wizard
Published from commit a345f2b by run 34633838735, which refuses to run on a push or a tag and uploads only after a named human approves the pypi environment. Self-check for that commit: run 34633040724.
This release is not approved, independently validated, or audited by being published. org/decisions/README.md records that no independent validator exists for this repository. Establishing one is what the packet below is for.
Artefacts
| File | sha256 |
|---|---|
INDEPENDENT_REVIEW_PACKET-0.18.0.html |
2cbdd97b510551009d8ea2fce7c4dcb3b9f54249ba165a1407c2a5f623496ba6 |
surfaceplate-0.18.0.zip |
bda9442b4808880ff6090e93ace39d67b6bd7ef8f067cf8dff38950142cb428a |
PyPI sdist surfaceplate-0.18.0.tar.gz |
6bdcacc9b8f815550131dba09b17a293b2696237ae191f833bf607bca1445125 |
PyPI wheel surfaceplate-0.18.0-py3-none-any.whl |
7de54c0f96dc4555405f71ff8d83074845a44921384c9f7747374eb4e6d3f96d |
A checksum proves integrity. It never proves authenticity or the absence of malicious content.
What the packet asks for
Two parts, and they need different things from a reviewer.
Part A — F6. Every integrity anchor in this project sits inside the boundary it checks, so the framework cannot verify its own digest. Closing it needs someone who is not the maintainer and who can execute — recomputing the manifest anchor independently and reporting what they got. A reviewer who can only read cannot close it, and the first cross-provider review said so, correctly.
Part B — the independent audit, which is the last item before 1.0.
F6 remains open in org/FINDINGS.md and will stay open until a recomputation is returned, recorded under governance/assurance/, and names a reviewer who is not the maintainer.
Supported Pythons
3.10, 3.11, 3.12 and 3.13 — each installed and exercised in CI on every push. 3.9 is not supported and the metadata now says so: jsonschema==4.26.0 requires >=3.10, so requires-python = ">=3.9" had never been true (F163).