Skip to content

chore: prep v0.0.28 #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 16, 2025
Merged

chore: prep v0.0.28 #145

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9314212
Update after moving repository to `pypi` org
facutuesca Oct 16, 2025
59d77f9
chore: prep v0.0.28
facutuesca Oct 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
138 changes: 76 additions & 62 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [0.0.28]

### Changed

- Upgraded `sigstore` dependency to `>=4.0.0`. Since version `4.0.0`,
`sigstore` supports signing using the new Rekor v2 instance, which
will become the default in the future. We force the version to 1,
so any attestations created with `pypi-attestations==0.0.28` will
still contain Rekor v1 entries.
- Repository has been moved to the `pypi` GitHub org. The new URL
is https://github.com/pypi/pypi-attestations.

## [0.0.27]

### Fixed
Expand All @@ -17,30 +29,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
string comparison. This fixes an issue where verification would fail
due to the artifact filename having the wheel tags in a different
order than the ones in the attestation.
([#127](https://github.com/trailofbits/pypi-attestations/pull/127))
([#127](https://github.com/pypi/pypi-attestations/pull/127))

## [0.0.26]

### Fixed

- This library no longer enforces distribution name "ultranormalization,"
which went above the requirements specified in PEP 740
([#124](https://github.com/trailofbits/pypi-attestations/pull/124))
([#124](https://github.com/pypi/pypi-attestations/pull/124))

## [0.0.25]

### Fixed

- Make the `GooglePublisher` type and APIs public
([#117](https://github.com/trailofbits/pypi-attestations/pull/117))
([#117](https://github.com/pypi/pypi-attestations/pull/117))

## [0.0.24]

### Added

- The `GooglePublisher` type has been added to support
Google Cloud-based Trusted Publishers
([#114](https://github.com/trailofbits/pypi-attestations/pull/114))
([#114](https://github.com/pypi/pypi-attestations/pull/114))

## [0.0.23]

Expand All @@ -64,15 +76,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
if the `Source Repository Ref` or `Source Repository Digest` claim
was missing from the attestation's certificate. We require at least
one of the two claims, but not necessarily both
([#109](https://github.com/trailofbits/pypi-attestations/pull/109))
([#109](https://github.com/pypi/pypi-attestations/pull/109))

## [0.0.22]

### Changed

- The `inspect` subcommand now ignores inputs that don't match `*.attestation`,
rather than failing on them
([#93](https://github.com/trailofbits/pypi-attestations/pull/93))
([#93](https://github.com/pypi/pypi-attestations/pull/93))

### Added

Expand All @@ -95,10 +107,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Changed

- The CLI entrypoint is now `pypi-attestations`
([#82](https://github.com/trailofbits/pypi-attestations/pull/82))
([#82](https://github.com/pypi/pypi-attestations/pull/82))
- The CLI `verify` subcommand has been changed to `verify attestation`,
as in `pypi-attestations verify attestation --identity ...`
([#82](https://github.com/trailofbits/pypi-attestations/pull/82))
([#82](https://github.com/pypi/pypi-attestations/pull/82))

### Added

Expand All @@ -108,14 +120,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
downloading it and its provenance from PyPI, verifying them using
`sigstore` and checking that the repository matches the one in the
PyPI provenance file.
([#82](https://github.com/trailofbits/pypi-attestations/pull/82))
([#82](https://github.com/pypi/pypi-attestations/pull/82))

## [0.0.20]

### Changed

- Explicitly support sigstore-python 3.6
([#79](https://github.com/trailofbits/pypi-attestations/pull/79))
([#79](https://github.com/pypi/pypi-attestations/pull/79))

## [0.0.19]

Expand All @@ -127,26 +139,26 @@ This is a corrective release for [0.0.18].

- The `Attestation` type now has a `certificate_claims` property to expose
underlying Fulcio signing certificate extensions
([#70](https://github.com/trailofbits/pypi-attestations/pull/70))
([#70](https://github.com/pypi/pypi-attestations/pull/70))

## [0.0.17]

### Fixed

- The `GitLabPublisher` policy now takes the workflow file path in order to
verify attestations, rathen than assuming it will always be `gitlab-ci.yml`
([#71](https://github.com/trailofbits/pypi-attestations/pull/71)).
([#71](https://github.com/pypi/pypi-attestations/pull/71)).
- The `GitLabPublisher` now longer expects claims being passed during construction,
rather the `ref` and `sha` claims are extracted from the certificate's extensions,
similar to `GitHubPublisher`'s behavior
([#71](https://github.com/trailofbits/pypi-attestations/pull/71)).
([#71](https://github.com/pypi/pypi-attestations/pull/71)).


### Changed

- Publisher classes (`GitLabPublisher` and `GitHubPublisher`) no longer take a claims
dictionary during construction
([#72](https://github.com/trailofbits/pypi-attestations/pull/72)).
([#72](https://github.com/pypi/pypi-attestations/pull/72)).

## [0.0.16]

Expand All @@ -165,19 +177,19 @@ This is a corrective release for [0.0.14].

- The `Distribution` API now handles ZIP source distributions
(those ending with `.zip`) instead of rejecting them as invalid
([#68](https://github.com/trailofbits/pypi-attestations/pull/68))
([#68](https://github.com/pypi/pypi-attestations/pull/68))

## [0.0.13]

### Changed

- The minimum Python version required has been brought back to `3.9`
([#64](https://github.com/trailofbits/pypi-attestations/pull/64)).
([#64](https://github.com/pypi/pypi-attestations/pull/64)).

- The `Attestation.verify(...)` API has been changed to remove the `Verifier`
argument in favor of an optional `staging: bool` kwarg to select the
Sigstore instance
([#62](https://github.com/trailofbits/pypi-attestations/pull/62))
([#62](https://github.com/pypi/pypi-attestations/pull/62))

- The `Attestation.verify(...)` API has been changed to accept both `Publisher`
and `VerificationPolicy` objects as a policy. The publisher object is internally
Expand All @@ -190,7 +202,7 @@ This is a corrective release for [0.0.14].

- `python -m pypi_attestations verify` now exits with a non-zero exit code
if the verification step fails
([#57](https://github.com/trailofbits/pypi-attestations/pull/57))
([#57](https://github.com/pypi/pypi-attestations/pull/57))

## [0.0.12]

Expand All @@ -199,74 +211,74 @@ This is a corrective release for [0.0.14].
- Base64-encoded bytes inside Attestation objects contained newline characters
every 76 characters due to a bug in Pydantic's Base64Bytes type. Those
newlines were also (incorrectly) ignored by Pydantic during decoding
([#48](https://github.com/trailofbits/pypi-attestations/pull/48)).
([#48](https://github.com/pypi/pypi-attestations/pull/48)).

## [0.0.11]

### Changed

- The minimum version of sigstore-python is now `3.2.0`, owing to private
API changes ([#45](https://github.com/trailofbits/pypi-attestations/pull/45))
API changes ([#45](https://github.com/pypi/pypi-attestations/pull/45))

## [0.0.10]

### Changed

- The minimum Python version required has been bumped to `3.11`
([#37](https://github.com/trailofbits/pypi-attestations/pull/37))
([#37](https://github.com/pypi/pypi-attestations/pull/37))

### Added

- The `Provenance`, `Publisher`, `GitHubPublisher`, `GitLabPublisher`, and
`AttestationBundle` types have been added
([#36](https://github.com/trailofbits/pypi-attestations/pull/36)).
([#36](https://github.com/pypi/pypi-attestations/pull/36)).

## [0.0.9]

### Added

- The `Distribution` type and APIs have been added, allowing a user to supply
a pre-computed digest instead of performing I/O
([#34](https://github.com/trailofbits/pypi-attestations/pull/34))
([#34](https://github.com/pypi/pypi-attestations/pull/34))

### Changed

- `sign` and `verify` no longer perform I/O
([#34](https://github.com/trailofbits/pypi-attestations/pull/34))
([#34](https://github.com/pypi/pypi-attestations/pull/34))


### Fixed

- `verify`: catch another leaky error case
([#32](https://github.com/trailofbits/pypi-attestations/pull/32))
([#32](https://github.com/pypi/pypi-attestations/pull/32))


## [0.0.8]

### Fixed

- `AttestationType` is now re-exported at the top-level as a public API
([#31](https://github.com/trailofbits/pypi-attestations/pull/31))
([#31](https://github.com/pypi/pypi-attestations/pull/31))

## [0.0.7]

### Added

- `AttestationType` has been added, as an enumeration of all currently known
attestation types (by URL)
([#29](https://github.com/trailofbits/pypi-attestations/pull/29))
([#29](https://github.com/pypi/pypi-attestations/pull/29))

### Changed

- `Attestation.verify` now checks the attestation's type against
`AttestationType` before returning it
([#29](https://github.com/trailofbits/pypi-attestations/pull/29))
([#29](https://github.com/pypi/pypi-attestations/pull/29))

### Fixed

- `Attestation.sign` now only returns `AttestationError` when failing to sign a
distribution file
([#28](https://github.com/trailofbits/pypi-attestations/pull/28))
([#28](https://github.com/pypi/pypi-attestations/pull/28))

## [0.0.6]

Expand All @@ -276,28 +288,28 @@ This is a corrective release for [0.0.14].
intended for local development, and not for external use. Its flags and
commands are not subject to stabilization unless explicitly documented
in a future release
([#22](https://github.com/trailofbits/pypi-attestations/pull/22))
([#22](https://github.com/pypi/pypi-attestations/pull/22))

### Changed

- The name of this project is now `pypi-attestations`, renamed from
`pypi-attestion-models` ([#25](https://github.com/trailofbits/pypi-attestations/pull/25))
`pypi-attestion-models` ([#25](https://github.com/pypi/pypi-attestations/pull/25))

- The model conversion functions have been moved into the `Attestation` class
([#24](https://github.com/trailofbits/pypi-attestations/pull/24))
([#24](https://github.com/pypi/pypi-attestations/pull/24))

## [0.0.5] - 2024-06-20

### Added

- `Attestation.verify` now returns the inner statement's predicate components
([#20](https://github.com/trailofbits/pypi-attestations/pull/20))
([#20](https://github.com/pypi/pypi-attestations/pull/20))

## [0.0.4] - 2024-06-11

### Changed

- Switch to in-toto statements ([#18](https://github.com/trailofbits/pypi-attestations/pull/18))
- Switch to in-toto statements ([#18](https://github.com/pypi/pypi-attestations/pull/18))

## [0.0.3] - 2024-06-10

Expand All @@ -315,31 +327,33 @@ This is a corrective release for [0.0.14].

- Initial implementation

[Unreleased]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.27...HEAD
[0.0.27]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.26...v0.0.27
[0.0.26]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.25...v0.0.26
[0.0.25]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.24...v0.0.25
[0.0.24]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.23...v0.0.24
[0.0.23]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.22...v0.0.23
[0.0.22]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.21...v0.0.22
[0.0.21]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.20...v0.0.21
[0.0.20]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.19...v0.0.20
[0.0.19]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.18...v0.0.19
[0.0.18]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.17...v0.0.18
[0.0.17]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.16...v0.0.17
[0.0.16]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.15...v0.0.16
[0.0.15]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.14...v0.0.15
[0.0.14]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.13...v0.0.14
[0.0.13]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.12...v0.0.13
[0.0.12]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.11...v0.0.12
[0.0.11]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.10...v0.0.11
[0.0.10]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.9...v0.0.10
[0.0.9]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.8...v0.0.9
[0.0.8]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.7...v0.0.8
[0.0.7]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.6...v0.0.7
[0.0.6]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.5...v0.0.6
[0.0.5]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.4...v0.0.5
[0.0.4]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.3...v0.0.4
[0.0.3]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.2...v0.0.3
[0.0.2]: https://github.com/trailofbits/pypi-attestation-models/compare/v0.0.1...v0.0.2
[0.0.1]: https://github.com/trailofbits/pypi-attestation-models/releases/tag/v0.0.1
[Unreleased]: https://github.com/pypi/pypi-attestations/compare/v0.0.28...HEAD
[0.0.28]: https://github.com/pypi/pypi-attestations/compare/v0.0.27...v0.0.28
[0.0.27]: https://github.com/pypi/pypi-attestations/compare/v0.0.26...v0.0.27
[0.0.26]: https://github.com/pypi/pypi-attestations/compare/v0.0.25...v0.0.26
[0.0.25]: https://github.com/pypi/pypi-attestations/compare/v0.0.24...v0.0.25
[0.0.24]: https://github.com/pypi/pypi-attestations/compare/v0.0.23...v0.0.24
[0.0.23]: https://github.com/pypi/pypi-attestations/compare/v0.0.22...v0.0.23
[0.0.22]: https://github.com/pypi/pypi-attestations/compare/v0.0.21...v0.0.22
[0.0.21]: https://github.com/pypi/pypi-attestations/compare/v0.0.20...v0.0.21
[0.0.20]: https://github.com/pypi/pypi-attestations/compare/v0.0.19...v0.0.20
[0.0.19]: https://github.com/pypi/pypi-attestations/compare/v0.0.18...v0.0.19
[0.0.18]: https://github.com/pypi/pypi-attestations/compare/v0.0.17...v0.0.18
[0.0.17]: https://github.com/pypi/pypi-attestations/compare/v0.0.16...v0.0.17
[0.0.16]: https://github.com/pypi/pypi-attestations/compare/v0.0.15...v0.0.16
[0.0.15]: https://github.com/pypi/pypi-attestations/compare/v0.0.14...v0.0.15
[0.0.14]: https://github.com/pypi/pypi-attestations/compare/v0.0.13...v0.0.14
[0.0.13]: https://github.com/pypi/pypi-attestations/compare/v0.0.12...v0.0.13
[0.0.12]: https://github.com/pypi/pypi-attestations/compare/v0.0.11...v0.0.12
[0.0.11]: https://github.com/pypi/pypi-attestations/compare/v0.0.10...v0.0.11
[0.0.10]: https://github.com/pypi/pypi-attestations/compare/v0.0.9...v0.0.10
[0.0.9]: https://github.com/pypi/pypi-attestations/compare/v0.0.8...v0.0.9
[0.0.8]: https://github.com/pypi/pypi-attestations/compare/v0.0.7...v0.0.8
[0.0.7]: https://github.com/pypi/pypi-attestations/compare/v0.0.6...v0.0.7
[0.0.6]: https://github.com/pypi/pypi-attestations/compare/v0.0.5...v0.0.6
[0.0.5]: https://github.com/pypi/pypi-attestations/compare/v0.0.4...v0.0.5
[0.0.4]: https://github.com/pypi/pypi-attestations/compare/v0.0.3...v0.0.4
[0.0.3]: https://github.com/pypi/pypi-attestations/compare/v0.0.2...v0.0.3
[0.0.2]: https://github.com/pypi/pypi-attestations/compare/v0.0.1...v0.0.2
[0.0.1]: https://github.com/pypi/pypi-attestations/releases/tag/v0.0.1

6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# pypi-attestations

<!--- BADGES: START --->
[![CI](https://github.com/trailofbits/pypi-attestations/actions/workflows/tests.yml/badge.svg)](https://github.com/trailofbits/pypi-attestations/actions/workflows/tests.yml)
[![CI](https://github.com/pypi/pypi-attestations/actions/workflows/tests.yml/badge.svg)](https://github.com/pypi/pypi-attestations/actions/workflows/tests.yml)
[![PyPI version](https://badge.fury.io/py/pypi-attestations.svg)](https://pypi.org/project/pypi-attestations)
[![Packaging status](https://repology.org/badge/tiny-repos/python:pypi-attestations.svg)](https://repology.org/project/python:pypi-attestations/versions)
<!--- BADGES: END --->
Expand Down Expand Up @@ -200,9 +200,9 @@ limitations under the License.

[PEP 740]: https://peps.python.org/pep-0740/

[here]: https://trailofbits.github.io/pypi-attestations
[here]: https://pypi.github.io/pypi-attestations

[public Python APIs]: https://trailofbits.github.io/pypi-attestations
[public Python APIs]: https://pypi.github.io/pypi-attestations

[the official PyPA publishing action]: https://github.com/pypa/gh-action-pypi-publish

Expand Down
7 changes: 4 additions & 3 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ readme = "README.md"
license = "Apache-2.0"
license-files = ["LICENSE"]
authors = [{ name = "Trail of Bits", email = "opensource@trailofbits.com" }]
maintainers = [{ name = "PyPI Admins", email = "admin@pypi.org" }]
classifiers = ["Programming Language :: Python :: 3"]
dependencies = [
"cryptography",
Expand Down Expand Up @@ -48,9 +49,9 @@ pypi-attestations = "pypi_attestations._cli:main"

[project.urls]
Homepage = "https://pypi.org/project/pypi-attestations"
Documentation = "https://trailofbits.github.io/pypi-attestations/"
Issues = "https://github.com/trailofbits/pypi-attestations/issues"
Source = "https://github.com/trailofbits/pypi-attestations"
Documentation = "https://pypi.github.io/pypi-attestations/"
Issues = "https://github.com/pypi/pypi-attestations/issues"
Source = "https://github.com/pypi/pypi-attestations"

[tool.flit.module]
name = "pypi_attestations"
Expand Down
2 changes: 1 addition & 1 deletion src/pypi_attestations/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
"""The `pypi-attestations` APIs."""

__version__ = "0.0.27"
__version__ = "0.0.28"

from ._impl import (
Attestation,
Expand Down
Loading