codeimprint 0.5.0a11__tar.gz

codeimprint-0.5.0a11/.gitignore

@@ -0,0 +1,14 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.venv/
+venv/
+dist/
+build/
+*.egg-info/
+
+# Local runs of the client
+workspace/
+codeimprint-result.json
+.env

codeimprint-0.5.0a11/CHANGELOG.md

@@ -0,0 +1,266 @@
+# Changelog
+
+## 0.5.0a11 — Project names, `imprint github link`, identity offer [CIM-BE-19-v1]
+
+- `imprint init` names the project `owner/repo` from the `origin` remote, else the folder's
+  name (`--name` to choose); with an existing project, `--name` renames it.
+- `imprint project rename <name> [--private]`: a new display name, signed by your developer key.
+- `imprint github link`: for a repository sealed by the CodeImprint GitHub App (engine
+  0.7.0a16). Upgrades the App's project to your own key (the App's key adds yours; your key
+  signs the `INT1` authorisation), or attaches your existing project (your key adds the App's
+  key). Checks that the authorisation names your key and project before signing, verifies the
+  record's receipt, saves it in `.imprint/`, and records the project in `.imprint/config.json`
+  when there was none.
+- Onboarding: `imprint init` (and the first `imprint seal` on a server) offers to bind the
+  developer key's identity when it has none (`imprint identity bind --level email`); it asks
+  (y/N), never binds silently, and in GitHub Actions or without a terminal only prints the hint.
+- `INT1` records are recognised by `imprint verify` (record type and ID prefix).
+
+Packaging [CIM-BE-20-v1]: the client's first PyPI release.
+
+- The distribution is now `codeimprint` (`pip install --pre codeimprint`); `code-imprint` is
+  a separate, code-free alias that installs `codeimprint` at the same version. The import
+  package (`codeimprint_cli`) and the command (`imprint`) are unchanged.
+  `imprint --version` prints `codeimprint <version>`; the User-Agent is `codeimprint/<version>`.
+- `.github/workflows/publish.yml`: on a tag `v*`, the thin-client check and the tests, then
+  both packages are built, checked (`twine check`, `scripts/check_release.py`: the tag matches
+  the versions, and only the client package and its notices ship) and published with Trusted
+  Publishing, `codeimprint` first (environment `pypi`), then the alias (`pypi-alias`).
+- The sdist holds only the package, `README.pypi.md`, `CHANGELOG.md`, `LICENSE` and `NOTICE`.
+- An existing install from a folder under the old name must be removed first:
+  `pip uninstall code-imprint`, then `pip install codeimprint`.
+- No GitHub Action reference any more: the workflow `imprint init` writes installs the client
+  with `pip install --pre codeimprint` and runs `imprint seal` / `imprint check` directly, with
+  `CODEIMPRINT_URL`, `CODEIMPRINT_TOKEN` and `CODEIMPRINT_DEVELOPER_KEY` from secrets (a
+  `CODEIMPRINT_URL` repository variable still works). Without a URL (pull requests from forks)
+  the jobs are skipped with a notice. Actions `checkout`, `setup-python` and `upload-artifact`
+  at v7. The README's pre-commit example is a local hook. `imprint init --force` rewrites an
+  existing workflow.
+
+## 0.5.0a10 — Line count per seal [CIM-BE-17-v1]
+
+- `imprint seal` counts the project's non-blank lines (docs/line-count.md, rules `lines/1`):
+  the files Git tracks at the sealed commit, without binary, vendored and generated files,
+  with `linguist-vendored` / `linguist-generated` from `.gitattributes` (`git check-attr` at
+  the commit). Outside Git (or `--zip`): the folder's files, `.gitignore` applied. The count
+  and a per-language breakdown are sent with the seal and printed:
+  `Lines      123,456 (Python 80%, TypeScript 20%)`.
+- The engine (0.7.0a15) keeps the count in the Imprint's public header, so the digest you
+  sign covers it; the client refuses to treat a seal as done if the sealed Imprint carries a
+  different count. Older engines ignore it.
+- Fast on large repositories: one `git check-attr` and one streamed `git cat-file --batch`
+  per count, path rules before any content is read, and a per-blob cache in the Git
+  directory (`codeimprint-lines.json`; blobs are content-addressed, so it never goes stale).
+- Production engines now require an account for sealing (`imprint login`, or an API token in
+  automated builds); public verification is unchanged.
+
+## 0.5.0a9 — Hub links from the server, verify default, rust badge [CIM-BE-14-v1]
+
+- The verify link and README badge use the hub the server names (`public_url` in its keys
+  file, engine 0.7.0a11). Order: `imprint seal --hub-url`, then `CODEIMPRINT_HUB_URL`, then the
+  server's hub, refreshed on every `imprint login` and every seal and cached per server URL in
+  the user config (`hubs`). With none known, no link or badge is printed, only
+  `imprint verify <file>`; never a localhost guess. A localhost hub is kept only from a
+  localhost server, and any other hub only over HTTPS.
+- **Changed:** `CODEIMPRINT_PUBLIC_URL`, the saved `public_url` and the `https://mudrika.io`
+  default are no longer used; `imprint login --public-url` is accepted but ignored, with a
+  warning. The terms hint names the hub's account page when the hub is known.
+- `imprint verify` with no target checks `.imprint/baseline.imprint` in the current folder;
+  without one, the usual usage error.
+- The badge is rust, `B23C0C`.
+- No change to sealing, receipts, the log or verification.
+
+## 0.5.0a8 — Servers behind Cloudflare Access [CIM-BE-13-v1]
+
+- A Cloudflare Access service token (`CODEIMPRINT_CF_ACCESS_CLIENT_ID` and
+  `CODEIMPRINT_CF_ACCESS_CLIENT_SECRET`, or `imprint login --cf-access`, saved in the user-only
+  config file) is sent as `CF-Access-Client-Id` / `CF-Access-Client-Secret`, only to the
+  configured server's host and only over HTTPS (or HTTP to this machine).
+- The client no longer follows redirects (one would have carried the token and the Access
+  secret to wherever it pointed); Access's login redirect and its 401/403 page now give a clear
+  message.
+
+## 0.5.0a7 — Terms acceptance [CIM-BE-10-v1]
+
+- Commands that create records (`identity bind`, `claim create | add-key | retire-key`,
+  `assign`, `contributor`, `org` except `show` and `end`) send them with your signed-in session
+  (`imprint login`), as engine 0.7.0a8 requires. When the server answers that the terms are
+  not accepted yet, the client says so and names the account page (`<public URL>/account`)
+  to accept them; `imprint login` says so too.
+
+## 0.5.0a6 — Organisation and contributor commands [CIM-BE-9-v6]
+
+- `imprint org create | show | domain | verify | disclose | join | approve | end`: create an
+  organisation (signed in), verify a domain by DNS TXT record (the challenge is kept on your
+  machine between `domain` and `verify`), disclose it, join (by admin approval, with a file
+  the admin completes with `approve`, or at once with a company-domain sign-in) and end a
+  membership. Statements the server prepares are signed only when they match their document.
+- `imprint contributor`: a contributor record signed by the contributor and a project key,
+  optionally with an agreement (committed by salted hash) that assigns to a claim; one side
+  writes a file, the other completes it with `--complete`.
+
+## 0.5.0a5 — "Already sealed" answers [CIM-BE-8-v5]
+
+- Reads engine 0.7.0a5's Git plan answer for a tree already sealed (`already_sealed: true`
+  with the seal's `id`) as well as earlier engines' (`already_sealed` = the ID), so
+  `imprint seal` names the existing seal either way.
+
+## 0.5.0a4 — Ownership claims [CIM-BE-9-v5]
+
+- `imprint claim create` (person or `--org`; `--basis`, `--effective-at`, `--share`,
+  `--jurisdiction`, `--document KIND=FILE` sends only a salted hash and keeps the salt in
+  `.imprint/claims/`, `--also-sign KEYFILE` for each other listed key), `claim show`,
+  `claim withdraw`, `claim add-key` and `claim retire-key`. Each asks first (`--yes` to skip)
+  and states that the claimant warrants the claim is truthful.
+- `imprint assign CLM1-… --from TIME [--until TIME]`: an assignment signed by both sides; one
+  side writes a file, the other completes it with `--complete FILE`.
+- `imprint ownership show`: fetches the project's ownership listing and verifies it in full:
+  every record's receipt, consent of every listed key, the claimant's identity level and
+  window, an organisation's disclosure, membership windows from their records, withdrawals,
+  and **each seal's coverage recomputed** from the seals' own receipts. Works with engine
+  0.7.0a4.
+
+## 0.5.0a3 — Organisation records [CI-BE-9-v4]
+
+- `imprint verify` checks membership records (`MBR1`): the member key signed; an
+  admin-approved membership also carries the organisation admin's signature, a domain-proven one
+  does not. Disclosure records (`DSC1`) and domain-level identity records verify like other
+  records. Works with engine 0.7.0a3.
+
+## 0.5.0a2 — Sign-in and verified identity [CI-BE-9-v3]
+
+- `imprint login` now **signs in** (engine 0.7.0a2): it opens the browser (or prints the link
+  with `--no-browser`; `--provider github|gitlab|google|microsoft|email`, `--email`), shows a
+  code the browser must match, and saves a short-lived session. The API-token flow stays as
+  `--api-token` or `--token-stdin` (CI).
+- `imprint identity bind --level email|vcs` binds your developer key to the sign-in (the key
+  signs the server's challenge) and saves the identity record's receipt; `identity show`;
+  `identity revoke [IDT1-…] [--reason key-compromised --compromised-since TIME]`.
+- `imprint verify` checks identity records (the key's signature over its request, expiry) and
+  revocations; online, a revoked or expired identity fails, and a seal signed by a key at or
+  after its reported compromise is flagged.
+
+## 0.5.0a1 — Ownership records: verification [CI-BE-9-v2]
+
+- `imprint verify` checks ownership records (receipt format 4, engine 0.7.0a1): the record
+  document against its digest and typed ID (`IDT1-…`, `CLM1-…`, …), the attestation's kind,
+  project, parents and signers, every owner signature and the roles the type requires, then
+  the log and timestamps as for seals. Online, records are fetched from
+  `/api/v1/public/records/{id}`.
+- Typed IDs check the prefix with the body, so a mistyped prefix is caught.
+
+## 0.4.0a3 — Sealed zips and release-tag consistency [CI-BE-8-v4]
+
+- Git seals never send `.imprint/` paths; committing a seal and its receipt answers
+  "already sealed" (engine 0.6.0a3).
+- A release of a tree not sealed before shows its tag (private by default, `--public-tag`),
+  and `imprint verify` checks that the Imprint's `release` field matches the attested one.
+
+## 0.4.0a2 — Release records [CI-BE-8-v3]
+
+- `imprint seal --kind release` on a commit whose tree is already sealed now adds a signed,
+  logged and timestamped release record (`REL1-…`) labelling that seal, instead of only
+  answering "already sealed". The tag comes from the commit or `--tag NAME`; it stays private
+  (a salted commitment is public) unless `--public-tag`. The receipt is saved as
+  `.imprint/<REL1 ID>.receipt.json`; the same tag again answers "already released".
+- `imprint verify` checks release records: the document against its digest, `REL1` ID and
+  chain, and online that the released seal has the named digest and came earlier.
+- GitHub Action: `public-tag` input.
+
+## 0.4.0a1 — Git-aware sealing [CI-BE-8-v2]
+
+- `imprint init` creates the project and its **genesis seal** (needs a server: `imprint login`
+  first, or `--url`; `--no-project` skips it), stores `project_id` in `.imprint/config.json`
+  and saves `.imprint/genesis.imprint` and its receipt.
+- `imprint seal` in a Git repository uses the **incremental protocol**: it sends the commit's
+  file list, uploads only the files the server asks for, and signs the prepared seal into the
+  project's chain. `--kind commit|push|release`, `--rev`, `--all-commits RANGE`, `--zip`.
+  Outside Git, zip seals join the project's chain too.
+- `imprint hook install --on commit|push` and `imprint hook run`: hooks never block; offline,
+  seals queue in `.git/codeimprint/queue` and are flushed on the next run.
+- `imprint chain` (the server's chain with this clone's commits) and `imprint export <ID>`
+  (the full Imprint of a Git seal, checked against the seal).
+- `imprint verify` checks receipt format 3: attestation v2 and log entry v2, the developer's
+  chain signature (it counts as the developer signature), the manifest root, and online that
+  the signer was a project key at the seal's time.
+- GitHub Action: `kind` input; the workflow seals pushes as `push` and tags as `release`.
+- The test image installs `git`.
+
+## Unreleased [CI-BE-7-v1]
+
+- Public-URL setting for badge and verify links: `CODEIMPRINT_PUBLIC_URL`, or
+  `imprint login --public-url URL` (saved in the user config). Default `https://mudrika.io`;
+  launch value `https://app.codeimprint.ai`.
+- The log origin is no longer fixed in the client: a checkpoint must carry its receipt's
+  origin, and with `--online` the live log must still have it. Servers can now run under
+  another origin (for launch, `codeimprint.ai/log/v1`).
+
+## 0.3.0a1 — timestamps from two independent TSAs [CI-BE-5-v2]
+
+- **Pinned TSA roots.** A timestamp token now counts only if its signer certificate has the
+  time-stamping key usage marked critical, was valid at `genTime`, and chains through CA
+  certificates valid at that time to a pinned root: DigiCert Trusted Root G4, USERTrust RSA
+  (Sectigo) or GlobalSign Root R6 (spare), from the Mozilla root store. Before, any
+  certificate carried in the token was accepted, including a self-signed one. Other TSAs
+  fail unless trusted with `--tsa-certs FILE` (on `verify` and `seal`).
+- **Receipt format 2.** Several tokens per seal and per checkpoint, one entry per TSA (ok,
+  unavailable or invalid), a server-signed record of every answer, and the TSA list
+  committed in the signed attestation and checkpoint: a removed, swapped or relabelled
+  token fails. Format 1 receipts still verify.
+- `imprint verify` prints one line per TSA for the seal and the checkpoint. Any token that
+  is present but invalid fails; valid tokens more than an hour apart fail; any token earlier
+  than the attested time fails; an unavailable TSA is a warning.
+- `imprint seal` prints the timestamp lines and the receipt's warnings, and in GitHub Actions
+  adds them to the run's summary page (no other change to the Action).
+- Fixed: RFC 3161 tokens from real TSAs were not parsed (the TSTInfo content type was not
+  registered); only the test TSA's tokens were.
+- `docs/how-sealing-works.md`: why two TSAs, the pinned roots and their fingerprints, the
+  extended threat model. Real DigiCert, Sectigo and GlobalSign tokens are kept as offline
+  test fixtures.
+
+## 0.2.0a1 — tamper-evident seals [CI-BE-5-v1]
+
+- `imprint init` creates an Ed25519 **developer key** in the user config folder (0600; never
+  uploaded, never in the repository) and records its fingerprint in `.imprint/config.json`.
+  `--no-key` skips it. The workflow it writes now also seals on pushes to `main` and on tags.
+- `imprint seal` checks the server's attestation, log entry, inclusion proof and checkpoint
+  against its published keys (trusted on first use, then only ever extended), signs the
+  digest locally, uploads the signature, and saves `.imprint/baseline.receipt.json` and
+  `.imprint/server-keys.json` next to the Imprint. It prints the log entry, timestamp status,
+  badge and `https://mudrika.io/i/<ID>`. In CI every failure after the upload is a warning.
+- `imprint verify <file|receipt|ID>` checks digest, attestation, developer signature, log
+  inclusion, RFC 3161 timestamp and time order offline, one `PASS`/`WARN`/`FAIL` line each;
+  `--online` adds log consistency, entry order and the public record; `--keys FILE` pins
+  server keys; `--strict` fails on warnings. A file without a receipt is checked as before.
+- GitHub Action: `mode: seal` with `developer-key`, uploading the seal, receipt and keys as
+  a build artifact.
+- New `docs/how-sealing-works.md`: guarantees, threat model, limits, verification steps.
+- New dependency: `asn1crypto` (RFC 3161 tokens).
+
+## Unreleased [CI-BE-4-v2]
+
+- `docs/imprint-format.md`: the opaque layout is used by `imp1-p2` and `imp1-p3` (spec 0.2 or
+  0.3); the header fields are unchanged. Integration tests accept either.
+
+## Unreleased [CI-BE-4-v1]
+
+- `docs/imprint-format.md` describes the opaque `imp1-p2` layout (public header + encrypted
+  payload, digest and signature over both) and keeps `imp1-p1` as the older layout.
+  `imprint verify` needs no change: it already verifies whatever the body holds.
+- Verify tests use `imp1-p2` Imprints made by the engine, signed and unsigned, alongside the
+  older `imp1-p1` ones.
+- The client has its own public example projects (`tests/fixtures/projects`); integration
+  tests and the compose file no longer use the engine's examples.
+
+## 0.1.0a1 — unreleased
+
+First release of the public CodeImprint client [CI-BE-3-v2].
+
+- `imprint login`, `init`, `seal`, `check` and `verify` (offline digest and Ed25519 check).
+- Uploads only Python sources, respecting `.gitignore` (root and nested) and
+  `.imprint/config.json` excludes, and shows what will be sent before sending it.
+- `check` degrades to a warning on network, auth, rate-limit and server problems; only a
+  score at or above `--fail-above` fails.
+- Composite GitHub Action and pre-commit hook (pre-push).
+- `docs/imprint-format.md`: the public `.imprint` format and verification rules.
+- Thin-client guard (`scripts/check_thin_client.py`) in CI and tests.

codeimprint-0.5.0a11/LICENSE

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

codeimprint-0.5.0a11/NOTICE

@@ -0,0 +1,11 @@
+CodeImprint client by Mudrika
+Copyright 2026 Mudrika
+
+Licensed under the Apache License, Version 2.0 (see LICENSE).
+
+This client calls a CodeImprint server. It contains no part of the IMP-1 engine, which is
+proprietary to Mudrika and is not covered by this licence.
+
+"Mudrika" and "CodeImprint" are trademarks of their owner. The Apache License does not grant
+permission to use these names except as required for reasonable and customary use in
+describing the origin of the work.

codeimprint-0.5.0a11/PKG-INFO

@@ -0,0 +1,92 @@
+Metadata-Version: 2.5
+Name: codeimprint
+Version: 0.5.0a11
+Summary: CodeImprint by Mudrika: seal your code with a CodeImprint server (tamper-evident, logged and timestamped) and verify seals offline.
+Project-URL: Homepage, https://codeimprint.ai
+Project-URL: Hub, https://app.codeimprint.ai
+Author: Mudrika
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: code provenance,code sealing,github actions,software birthmark,transparency log
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Version Control :: Git
+Requires-Python: >=3.10
+Requires-Dist: asn1crypto>=1.5
+Requires-Dist: cryptography>=42
+Requires-Dist: pathspec>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff==0.17.2; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# CodeImprint by Mudrika — command-line client
+
+**Code provenance that survives AI.** CodeImprint seals your code: every seal is an
+**Imprint**, a compact signature of the code that is tamper-evident, recorded in a public
+transparency log and timestamped, so it cannot be altered or backdated without detection. An
+Imprint still matches when the code is renamed, reformatted, reordered or rewritten, and it
+does not contain your source.
+
+This package is the command-line client, `imprint`. It talks to a CodeImprint server, which
+does the analysis; the client sends your files, checks what the server returns and verifies
+seals offline. Learn more at [codeimprint.ai](https://codeimprint.ai).
+
+> **Pre-release (alpha).** Install with `--pre`. Python 3.10 or newer.
+
+## Install
+
+```bash
+pip install --pre codeimprint
+```
+
+(`pip install --pre code-imprint` installs the same package.)
+
+## Get started
+
+```bash
+imprint login --url https://api.codeimprint.ai    # sign in (browser or e-mail link)
+imprint init                                       # your developer key, the project and its first seal
+imprint seal .                                     # seal the current commit
+imprint verify                                     # check the seal offline
+```
+
+- **`imprint login`** saves the server and your sign-in in your user config folder, readable
+  by you only. In GitHub Actions, use an API token: `imprint login --token-stdin`, or the
+  `CODEIMPRINT_URL` and `CODEIMPRINT_TOKEN` environment variables.
+- **`imprint init`** creates your Ed25519 developer key in the user config folder (it is
+  never uploaded and never written to the repository), writes `.imprint/config.json` and a
+  GitHub Actions workflow, and creates the project, named `owner/repo` from the `origin`
+  remote.
+- **`imprint seal .`** shows what it is about to send and asks first (`--yes` skips the
+  question). Only the files that changed since the last seal are sent. It checks the server's
+  signature and log proof, signs the result with your developer key, and prints the Imprint
+  ID and a link to its public page on [app.codeimprint.ai](https://app.codeimprint.ai).
+- **`imprint verify`** checks a seal offline: digest, server attestation, your signature, log
+  inclusion and the RFC 3161 timestamp. `--online` also checks the live log.
+
+Other commands: `imprint check` (compare a project with a protected Imprint; similarity is
+evidence, not proof), `imprint chain`, `imprint hook install`, `imprint identity`,
+`imprint claim`, `imprint github link` and more. Run `imprint --help`.
+
+## What leaves your machine
+
+`imprint seal` and `imprint check` upload the project's files to the CodeImprint server you
+signed in to, which fingerprints them and deletes them at once; only the Imprint is kept.
+Your developer key never leaves your machine: only its public half is sent.
+
+## Licence
+
+Apache-2.0. The client contains no part of the CodeImprint engine, which runs on the server.
+"Mudrika" and "CodeImprint" are trademarks of their owner (see NOTICE).

codeimprint-0.5.0a11/README.pypi.md

@@ -0,0 +1,59 @@
+# CodeImprint by Mudrika — command-line client
+
+**Code provenance that survives AI.** CodeImprint seals your code: every seal is an
+**Imprint**, a compact signature of the code that is tamper-evident, recorded in a public
+transparency log and timestamped, so it cannot be altered or backdated without detection. An
+Imprint still matches when the code is renamed, reformatted, reordered or rewritten, and it
+does not contain your source.
+
+This package is the command-line client, `imprint`. It talks to a CodeImprint server, which
+does the analysis; the client sends your files, checks what the server returns and verifies
+seals offline. Learn more at [codeimprint.ai](https://codeimprint.ai).
+
+> **Pre-release (alpha).** Install with `--pre`. Python 3.10 or newer.
+
+## Install
+
+```bash
+pip install --pre codeimprint
+```
+
+(`pip install --pre code-imprint` installs the same package.)
+
+## Get started
+
+```bash
+imprint login --url https://api.codeimprint.ai    # sign in (browser or e-mail link)
+imprint init                                       # your developer key, the project and its first seal
+imprint seal .                                     # seal the current commit
+imprint verify                                     # check the seal offline
+```
+
+- **`imprint login`** saves the server and your sign-in in your user config folder, readable
+  by you only. In GitHub Actions, use an API token: `imprint login --token-stdin`, or the
+  `CODEIMPRINT_URL` and `CODEIMPRINT_TOKEN` environment variables.
+- **`imprint init`** creates your Ed25519 developer key in the user config folder (it is
+  never uploaded and never written to the repository), writes `.imprint/config.json` and a
+  GitHub Actions workflow, and creates the project, named `owner/repo` from the `origin`
+  remote.
+- **`imprint seal .`** shows what it is about to send and asks first (`--yes` skips the
+  question). Only the files that changed since the last seal are sent. It checks the server's
+  signature and log proof, signs the result with your developer key, and prints the Imprint
+  ID and a link to its public page on [app.codeimprint.ai](https://app.codeimprint.ai).
+- **`imprint verify`** checks a seal offline: digest, server attestation, your signature, log
+  inclusion and the RFC 3161 timestamp. `--online` also checks the live log.
+
+Other commands: `imprint check` (compare a project with a protected Imprint; similarity is
+evidence, not proof), `imprint chain`, `imprint hook install`, `imprint identity`,
+`imprint claim`, `imprint github link` and more. Run `imprint --help`.
+
+## What leaves your machine
+
+`imprint seal` and `imprint check` upload the project's files to the CodeImprint server you
+signed in to, which fingerprints them and deletes them at once; only the Imprint is kept.
+Your developer key never leaves your machine: only its public half is sent.
+
+## Licence
+
+Apache-2.0. The client contains no part of the CodeImprint engine, which runs on the server.
+"Mudrika" and "CodeImprint" are trademarks of their owner (see NOTICE).