@produtype/core 0.3.2 → 0.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -196,6 +196,20 @@ its own.
|
|
|
196
196
|
- Plan output is deterministic and read-only only
|
|
197
197
|
- No cloud dashboard or UI: this package is the CLI and the library
|
|
198
198
|
|
|
199
|
+
## Verifying what you installed
|
|
200
|
+
|
|
201
|
+
Every release from 0.3.3 onwards is published with npm provenance: an attestation,
|
|
202
|
+
signed during the release workflow, that ties the tarball to the commit and the build
|
|
203
|
+
that produced it.
|
|
204
|
+
|
|
205
|
+
```bash
|
|
206
|
+
npm view @produtype/core --json | grep -A5 provenance
|
|
207
|
+
```
|
|
208
|
+
|
|
209
|
+
Releases 0.3.0 to 0.3.2 have no attestation. They were published while this repository
|
|
210
|
+
was private, and provenance is only meaningful when anyone can read the commit it
|
|
211
|
+
points at.
|
|
212
|
+
|
|
199
213
|
## Roadmap
|
|
200
214
|
|
|
201
215
|
Shipped: the deterministic analyzer, deterministic remediation planning, and the
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@produtype/core",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.3",
|
|
4
4
|
"description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"bin": {
|