v0.0.59

Pain001 Release v0.0.59

Release Date: 2026-07-30
Tag: v0.0.59
Python: 3.10+
Status: Stable

Executive Summary

A supply-chain release. There is no runtime behaviour change and no
public API change — pip install --upgrade pain001 gets you identical
software. What changes is what can be proven about it: every dependency
of the published Docker image is now hash-pinned, and release provenance
covers every artefact rather than two of them.

Nothing here is urgent for a user of the library. It matters if you
verify what you install, or if you consume the container image.

Fixed

• The Docker image installed fastapi and uvicorn unpinned.
  requirements.txt is hash-pinned but covers only the base install, so
  pip install ".[api]" resolved the web stack from PyPI at image build
  time — whatever versions happened to be current that day. A new
  hash-pinned .github/requirements/api.txt (13 pins, 144 hashes) now
  supplies those dependencies, and the package itself is installed with
  --no-deps, so pip never resolves a third-party version. The same
  change applies to the docs and SDK workflows.

• Release provenance attested two of five artefacts. The SLSA
  provenance job hashed only dist/, while the CycloneDX and SPDX
  SBOMs are written to sbom/, so those three files shipped unattested
  in v0.0.58. All five release assets are now covered. This is the first
  release where that fix actually runs — v0.0.58's SBOMs were attested
  only by a manual backfill, which cannot carry the tag binding.

• The backfill workflow attested its own attestation. Re-attesting a
  release downloaded every asset, including the existing
  multiple.intoto.jsonl, listed it as a subject, and then overwrote
  it — leaving an attestation whose own subject digest matched nothing.
  *.intoto.jsonl is excluded before hashing, which also makes re-runs
  idempotent.

• preflight_release.py failed opaquely when run on an unpushed
  release commit: 1 problem(s): HEAD matches origin/main reads like
  something is wrong with the release rather than an ordering mistake.
  It now names the unpushed commit count and the fix.

Verifying this release

slsa-verifier verify-artifact pain001-0.0.59-py3-none-any.whl \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/sebastienrousseau/pain001

Unlike v0.0.59's predecessor, the same command now succeeds for the SBOM
files as well, and the provenance binds to refs/tags/v0.0.59 rather
than to a branch.

Upgrading

pip install --upgrade pain001

No API changes, no configuration changes, no regeneration needed.