v0.0.57

Pain001 Release v0.0.57

Release Date: 2026-07-28
Tag: v0.0.57
Python: 3.10+
Status: Stable

Executive Summary

A type-distribution and supply-chain release. There is no runtime
behaviour change and no public API change: every difference is in what ships
alongside the code — type information for downstream consumers, a clean
dependency set, hash-pinned build inputs, and, for the first time, a
cryptographically signed provenance attestation for the release artefacts.

What's in v0.0.57 at a glance

• PEP 561 py.typed marker. The package has been mypy --strict clean
  internally for several releases but shipped no marker, so downstream type
  checkers treated pain001 as untyped. The marker is now packaged in both
  the wheel and the sdist, and a regression test fails the build if it is
  ever dropped from the tree or the packaging include list.
• Dependency vulnerabilities cleared. requirements.txt had drifted from
  poetry.lock and pinned click==8.1.7 (PYSEC-2026-2132) and
  jsonschema==4.17.3; both are resynced to the locked 8.4.2 / 4.26.0.
  The transitive soupsieve is bumped 2.8.1 → 2.9.1
  (GHSA-2wc2-fm75-p42x, GHSA-836r-79rf-4m37). pip-audit reports no known
  vulnerabilities for the locked set.
• Hash-pinned build inputs. New pip-compile-generated
  .github/requirements/{fuzz,sbom,build-test,docs}.txt are installed with
  --require-hashes; requirements.txt now carries hashes; the unpinned
  pip install --upgrade pip steps are gone from the workflows and the
  Dockerfile; pipx install poetry is pinned to 2.4.1.
• Signed release provenance (new). This is the first release to carry a
  Sigstore-signed SLSA Build Level 3 provenance attestation
  (multiple.intoto.jsonl) generated on isolated infrastructure and attached
  to the release assets.
• Property test: in-memory and on-disk XSD validators agree. A Hypothesis
  test pins validate_xml_string_via_xsd (the serverless / in-memory path)
  and validate_via_xsd (the on-disk path) to the same verdict across valid
  and invalid documents, so a deployment-shape divergence cannot let a
  document pass one gate and fail the other.

Verifying this release

slsa-verifier verify-artifact pain001-0.0.57-py3-none-any.whl \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/sebastienrousseau/pain001

CycloneDX (JSON + XML) and SPDX licence SBOMs are attached to the release as
in previous versions.

Quality

• 1,425 tests passing, 100% line + branch coverage against a 100% enforced
  floor.
• mypy --strict clean, ruff clean (a long-standing UP031 finding in the
  fuzz harness is fixed, so the lint gate is green again), bandit clean,
  pip-audit reports no known vulnerabilities.
• OpenSSF Scorecard improved from 5.4 to 7.5 across these changes
  (Vulnerabilities 10/10, Pinned-Dependencies 8/10), with branch protection
  now requiring the quality, lint and CodeQL checks on main.

Upgrade notes

No breaking API or configuration changes; pip install --upgrade pain001 is
sufficient. Downstream projects using type checkers will begin to see
pain001's annotations for the first time — if your code was relying on
pain001 being implicitly Any, mypy may surface pre-existing type
mismatches at your call sites. That is the intended effect of the marker,
not a regression.