@sourcey/catalog-verifier 1.1.36 → 1.2.1

package/CHANGELOG.md

@@ -1,3 +1,13 @@
 # Changelog
 
 Release notes are maintained per immutable package version in GitHub Releases.
+
+## 1.2.0
+
+- Breaking: release verification leaves this package. `verify-release` and
+  `CatalogVerifierApplication.verifyRelease` are removed. A release is verified with the
+  exact verifier archive it names by digest.
+- The package carries only the contribution checks: `validate`, `pull-request`,
+  `identity-context-request` and `explain`.
+- The data repositories' validation retries the identity context when Sourcey's live
+  release advances during a check, instead of failing on the transient 409.

package/README.md

@@ -3,11 +3,17 @@
 `@sourcey/catalog-verifier` is Sourcey's deterministic contribution preflight for
 the [Startup Credits](https://github.com/sourcey/startup-credits) and
 [Agent Ready Services](https://github.com/sourcey/agent-ready-services) data
-repositories. It also verifies immutable Sourcey Catalog release bundles, and
-re-derives every Agent Readiness card in them from the declarations and run
-records they carry: every step and the letter from the declaration and its
-probe runs, and the job's proof from any run of a job binding, which marks the
-job verified and never changes a step or the letter.
+repositories.
+
+It does not verify Catalog releases. Each release names, by digest, the exact
+verifier archive that verifies it. That archive re-derives every Agent
+Readiness card the release carries from its declarations and run records. To
+verify a release, use the archive it names, published at
+`https://artifacts.sourcey.com/catalog/code/catalog-verifier/sha256-<digest>/`.
+Using that archive, rather than whichever version of this package is current,
+means a release is always judged by the verifier that admitted it. Since 1.2.0
+this package no longer has a `verify-release` command or
+`CatalogVerifierApplication.verifyRelease`.
 
 The verifier checks exact local candidate bytes. It does not crawl vendors,
 judge factual truth, prove submitter authority, run an Agent Readiness

package/SBOM.cdx.json

@@ -36,7 +36,7 @@
     "properties": [
       {
         "name": "sourcey:distribution-definition-sha256",
-        "value": "sha256:56c6104b1f8de751b08df2167b3f79ba41a06ea03281645af17a7e86f71f0da2"
+        "value": "sha256:210a640183995050c9c9a1e18d1a05fd34ce9cf365b0a5e074d5a45cb31d04b0"
       },
       {
         "name": "sourcey:toolchain-sha256",
@@ -121,54 +121,6 @@
         }
       ]
     },
-    {
-      "type": "library",
-      "bom-ref": "pkg:npm/tldts@7.4.16",
-      "name": "tldts",
-      "licenses": [
-        {
-          "expression": "MIT"
-        }
-      ],
-      "version": "7.4.16",
-      "purl": "pkg:npm/tldts@7.4.16",
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "43004447928c47ce88223a4888eec7fd9dc83093ec67503a44a3c0ab34d380ec944144adf4576729caa14da266918e8756b828b991d94749dc2b9431be69d07a"
-        }
-      ],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/tldts/-/tldts-7.4.16.tgz"
-        }
-      ]
-    },
-    {
-      "type": "library",
-      "bom-ref": "pkg:npm/tldts-core@7.4.16",
-      "name": "tldts-core",
-      "licenses": [
-        {
-          "expression": "MIT"
-        }
-      ],
-      "version": "7.4.16",
-      "purl": "pkg:npm/tldts-core@7.4.16",
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "303a257da489b6548ae58d00d71977dbbede92e6d9c286e9063ba09270e2cc8f4ee519bad1ad66f24e0808af8c46c083ccfca04fcd66a770417f944a0e51517c"
-        }
-      ],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.16.tgz"
-        }
-      ]
-    },
     {
       "type": "library",
       "bom-ref": "pkg:npm/yaml@2.9.1",
@@ -223,7 +175,6 @@
       "ref": "urn:sourcey:code-distribution:catalog-verifier",
       "dependsOn": [
         "pkg:npm/provenry@0.2.2",
-        "pkg:npm/tldts@7.4.16",
         "pkg:npm/yaml@2.9.1",
         "pkg:npm/zod@4.6.5"
       ]
@@ -245,16 +196,6 @@
         "pkg:npm/zod@4.6.5"
       ]
     },
-    {
-      "ref": "pkg:npm/tldts@7.4.16",
-      "dependsOn": [
-        "pkg:npm/tldts-core@7.4.16"
-      ]
-    },
-    {
-      "ref": "pkg:npm/tldts-core@7.4.16",
-      "dependsOn": []
-    },
     {
       "ref": "pkg:npm/yaml@2.9.1",
       "dependsOn": []