Repository navigation
What's Changed
- Fix release automation: explicitly dispatch release.yml instead of relying on the tag push by @smaniches in #51
- ci(security): ignore PYSEC-2026-3447 (setuptools <83) in pip-audit by @smaniches in #53
- chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #54
- chore(deps): bump the actions group with 2 updates by @dependabot[bot] in #55
- fix(sbom): derive release SBOM from exact published wheel by @smaniches in #58
- chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 in the actions group across 1 directory by @dependabot[bot] in #56
- ci(dependabot): ignore numpy 2.x version proposals by @smaniches in #60
- fix(science): correct holonomy and transport semantics by @smaniches in #61
Full Changelog: v0.1.0.dev4...v0.1.0.dev5
Note on these release assets
The files attached here were reconciled to the immutable PyPI 0.1.0.dev5
artifacts originally published by workflow run
31931064720 on
2026-08-16. A later run,
32427167884,
rebuilt the same tag and overwrote the mutable GitHub Release assets with
byte-different files; the two builds were content-identical and differed only in
embedded build timestamps, and PyPI, being immutable, was unaffected throughout.
The wheel and sdist here are byte-for-byte the PyPI artifacts:
| file | SHA-256 |
|---|---|
groupoid-0.1.0.dev5-py3-none-any.whl |
452c16ad642c8432b1ee46c661d9d50ed9de831061f10c01debf1c3a0b7187c4 |
groupoid-0.1.0.dev5.tar.gz |
99739902157798bf3443df2eb8beb7394ce04b77862ddefabe2c6d9547fd8dce |
sbom.cdx.json is run 31931064720's own SBOM, whose CycloneDX root component
binds the wheel above.
The two .sigstore.json bundles were reconstructed from that run's original
Rekor transparency-log entries (log indices 2484701423 and 2484701424) and
cryptographically verify the artifacts above. They are not byte-identical copies
of the originally published bundle files, because Rekor does not preserve the
RFC 3161 timestamp material; verification therefore proceeds via the inclusion
promise and the log's integrated time.
