codeimprint 0.5.0a11__tar.gz → 0.5.0a13__tar.gz

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.5.0a13 — The old brand name is gone [CIM-BE-26-v1]
+
+- **Development origin:** `receipt.ORIGIN`, the development log origin the tests' simulated
+  server uses, is now `codeimprint.dev/log/v1`, as in engine 0.7.0a18. Verification still takes
+  whatever origin a log publishes, so nothing changes for users. The name `ORIGIN` stays.
+- **Media type:** `docs/imprint-format.md` names `application/vnd.codeimprint.imprint+json`.
+- **History:** the changelog no longer names the old brand or its domain.
+- **Guard:** `tests/test_no_legacy_brand.py` fails if the old name appears anywhere in the tree.
+
+## 0.5.0a12 — Licensed under Apache-2.0 [CIM-BE-23-v1]
+
+- Licensed under Apache-2.0. Copyright 2026 Elystra Private Limited.
+  - `LICENSE` is now the full, unmodified Apache License 2.0 text, appendix included.
+    `tests/test_licence.py` pins its SHA-256.
+  - `NOTICE` names the copyright holder and the trademarks: "CodeImprint" and the logo are
+    trademarks of Elystra Private Limited, and the licence grants no rights to them
+    (section 6).
+  - Every source file under `src/` and `scripts/` starts with
+    `# SPDX-License-Identifier: Apache-2.0`.
+  - The metadata says `License-Expression: Apache-2.0` (PEP 639), and both files ship in the
+    wheel and the sdist.
+- The PyPI page no longer mentions the dropped `code-imprint` alias.
+- Elystra Private Limited is the legal owner. It is the PyPI author and maintainer, with
+  `dev@elystratech.com`. The product is "CodeImprint", without the old brand line, in
+  the READMEs, the PyPI description, `imprint --help` and the workflow `imprint init`
+  writes.
+
+Packaging [CIM-BE-20-v2]:
+
+- `.github/workflows/publish.yml` publishes with `skip-existing: true`: re-running a tag no
+  longer fails on files PyPI already has.
+
 ## 0.5.0a11 — Project names, `imprint github link`, identity offer [CIM-BE-19-v1]
 
 - `imprint init` names the project `owner/repo` from the `origin` remote, else the folder's
@@ -18,14 +50,13 @@
 
 Packaging [CIM-BE-20-v1]: the client's first PyPI release.
 
-- The distribution is now `codeimprint` (`pip install --pre codeimprint`); `code-imprint` is
-  a separate, code-free alias that installs `codeimprint` at the same version. The import
+- The distribution is now `codeimprint` (`pip install --pre codeimprint`). The import
   package (`codeimprint_cli`) and the command (`imprint`) are unchanged.
   `imprint --version` prints `codeimprint <version>`; the User-Agent is `codeimprint/<version>`.
 - `.github/workflows/publish.yml`: on a tag `v*`, the thin-client check and the tests, then
-  both packages are built, checked (`twine check`, `scripts/check_release.py`: the tag matches
-  the versions, and only the client package and its notices ship) and published with Trusted
-  Publishing, `codeimprint` first (environment `pypi`), then the alias (`pypi-alias`).
+  the package is built, checked (`twine check`, `scripts/check_release.py`: the tag matches
+  the version, and only the client package and its notices ship) and published with Trusted
+  Publishing (environment `pypi`).
 - The sdist holds only the package, `README.pypi.md`, `CHANGELOG.md`, `LICENSE` and `NOTICE`.
 - An existing install from a folder under the old name must be removed first:
   `pip uninstall code-imprint`, then `pip install codeimprint`.
@@ -62,8 +93,8 @@ Packaging [CIM-BE-20-v1]: the client's first PyPI release.
   the user config (`hubs`). With none known, no link or badge is printed, only
   `imprint verify <file>`; never a localhost guess. A localhost hub is kept only from a
   localhost server, and any other hub only over HTTPS.
-- **Changed:** `CODEIMPRINT_PUBLIC_URL`, the saved `public_url` and the `https://mudrika.io`
-  default are no longer used; `imprint login --public-url` is accepted but ignored, with a
+- **Changed:** `CODEIMPRINT_PUBLIC_URL`, the saved `public_url` and the old
+  default public URL are no longer used; `imprint login --public-url` is accepted but ignored, with a
   warning. The terms hint names the hub's account page when the hub is known.
 - `imprint verify` with no target checks `.imprint/baseline.imprint` in the current folder;
   without one, the usual usage error.
@@ -189,7 +220,7 @@ Packaging [CIM-BE-20-v1]: the client's first PyPI release.
 ## Unreleased [CI-BE-7-v1]
 
 - Public-URL setting for badge and verify links: `CODEIMPRINT_PUBLIC_URL`, or
-  `imprint login --public-url URL` (saved in the user config). Default `https://mudrika.io`;
+  `imprint login --public-url URL` (saved in the user config). Default: the old development domain;
   launch value `https://app.codeimprint.ai`.
 - The log origin is no longer fixed in the client: a checkpoint must carry its receipt's
   origin, and with `--online` the live log must still have it. Servers can now run under
@@ -227,7 +258,7 @@ Packaging [CIM-BE-20-v1]: the client's first PyPI release.
   against its published keys (trusted on first use, then only ever extended), signs the
   digest locally, uploads the signature, and saves `.imprint/baseline.receipt.json` and
   `.imprint/server-keys.json` next to the Imprint. It prints the log entry, timestamp status,
-  badge and `https://mudrika.io/i/<ID>`. In CI every failure after the upload is a warning.
+  badge and `<public URL>/i/<ID>`. In CI every failure after the upload is a warning.
 - `imprint verify <file|receipt|ID>` checks digest, attestation, developer signature, log
   inclusion, RFC 3161 timestamp and time order offline, one `PASS`/`WARN`/`FAIL` line each;
   `--online` adds log consistency, entry order and the public record; `--keys FILE` pins

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/LICENSE

@@ -1,7 +1,7 @@
 
                                  Apache License
                            Version 2.0, January 2004
-                        https://www.apache.org/licenses/
+                        http://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -175,3 +175,28 @@
       of your accepting any such warranty or additional liability.
 
    END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

codeimprint-0.5.0a13/NOTICE

@@ -0,0 +1,4 @@
+CodeImprint client — Copyright 2026 Elystra Private Limited.
+Licensed under the Apache License, Version 2.0.
+'CodeImprint' and the CodeImprint logo are trademarks of Elystra Private Limited; this licence
+grants no rights to use them (Apache-2.0 section 6).

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/PKG-INFO

@@ -1,10 +1,11 @@
 Metadata-Version: 2.5
 Name: codeimprint
-Version: 0.5.0a11
-Summary: CodeImprint by Mudrika: seal your code with a CodeImprint server (tamper-evident, logged and timestamped) and verify seals offline.
+Version: 0.5.0a13
+Summary: CodeImprint: seal your code with a CodeImprint server (tamper-evident, logged and timestamped) and verify seals offline.
 Project-URL: Homepage, https://codeimprint.ai
 Project-URL: Hub, https://app.codeimprint.ai
-Author: Mudrika
+Author-email: Elystra Private Limited <dev@elystratech.com>
+Maintainer-email: Elystra Private Limited <dev@elystratech.com>
 License-Expression: Apache-2.0
 License-File: LICENSE
 License-File: NOTICE
@@ -31,7 +32,7 @@ Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: ruff==0.17.2; extra == 'dev'
 Description-Content-Type: text/markdown
 
-# CodeImprint by Mudrika — command-line client
+# CodeImprint — command-line client
 
 **Code provenance that survives AI.** CodeImprint seals your code: every seal is an
 **Imprint**, a compact signature of the code that is tamper-evident, recorded in a public
@@ -51,8 +52,6 @@ seals offline. Learn more at [codeimprint.ai](https://codeimprint.ai).
 pip install --pre codeimprint
 ```
 
-(`pip install --pre code-imprint` installs the same package.)
-
 ## Get started
 
 ```bash
@@ -88,5 +87,10 @@ Your developer key never leaves your machine: only its public half is sent.
 
 ## Licence
 
-Apache-2.0. The client contains no part of the CodeImprint engine, which runs on the server.
-"Mudrika" and "CodeImprint" are trademarks of their owner (see NOTICE).
+Licensed under the [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)
+(the `LICENSE` and `NOTICE` files ship with the package). Copyright 2026 Elystra Private
+Limited. The client contains no part of the CodeImprint engine, which runs on the server and
+is proprietary.
+
+**Trademarks.** "CodeImprint" and the CodeImprint logo are trademarks of Elystra Private
+Limited; this licence grants no rights to use them (Apache-2.0 section 6).

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/README.pypi.md

@@ -1,4 +1,4 @@
-# CodeImprint by Mudrika — command-line client
+# CodeImprint — command-line client
 
 **Code provenance that survives AI.** CodeImprint seals your code: every seal is an
 **Imprint**, a compact signature of the code that is tamper-evident, recorded in a public
@@ -18,8 +18,6 @@ seals offline. Learn more at [codeimprint.ai](https://codeimprint.ai).
 pip install --pre codeimprint
 ```
 
-(`pip install --pre code-imprint` installs the same package.)
-
 ## Get started
 
 ```bash
@@ -55,5 +53,10 @@ Your developer key never leaves your machine: only its public half is sent.
 
 ## Licence
 
-Apache-2.0. The client contains no part of the CodeImprint engine, which runs on the server.
-"Mudrika" and "CodeImprint" are trademarks of their owner (see NOTICE).
+Licensed under the [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)
+(the `LICENSE` and `NOTICE` files ship with the package). Copyright 2026 Elystra Private
+Limited. The client contains no part of the CodeImprint engine, which runs on the server and
+is proprietary.
+
+**Trademarks.** "CodeImprint" and the CodeImprint logo are trademarks of Elystra Private
+Limited; this licence grants no rights to use them (Apache-2.0 section 6).

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/pyproject.toml

@@ -3,16 +3,17 @@ requires = ["hatchling>=1.27"]
 build-backend = "hatchling.build"
 
 [project]
-# Published on PyPI as `codeimprint` (and the alias `code-imprint`, alias/). The import
-# package stays `codeimprint_cli` and the command `imprint`.
+# Published on PyPI as `codeimprint`. The import package stays `codeimprint_cli` and the
+# command `imprint`.
 name = "codeimprint"
-version = "0.5.0a11"
-description = "CodeImprint by Mudrika: seal your code with a CodeImprint server (tamper-evident, logged and timestamped) and verify seals offline."
+version = "0.5.0a13"
+description = "CodeImprint: seal your code with a CodeImprint server (tamper-evident, logged and timestamped) and verify seals offline."
 readme = "README.pypi.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.10"
-authors = [{ name = "Mudrika" }]
+authors = [{ name = "Elystra Private Limited", email = "dev@elystratech.com" }]
+maintainers = [{ name = "Elystra Private Limited", email = "dev@elystratech.com" }]
 keywords = ["code provenance", "software birthmark", "code sealing", "transparency log",
             "github actions"]
 classifiers = [

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/__init__.py

@@ -1,7 +1,8 @@
-"""CodeImprint by Mudrika — command-line client.
+# SPDX-License-Identifier: Apache-2.0
+"""CodeImprint — command-line client.
 
 A thin client for a CodeImprint server: it zips a project, asks the server to seal or check
 it, and verifies Imprint files offline. All analysis happens on the server.
 """
 
-__version__ = "0.5.0a11"
+__version__ = "0.5.0a13"

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/__main__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 import sys
 
 from .cli import main

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/api.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """HTTP calls to a CodeImprint server (standard library only)."""
 
 from __future__ import annotations

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/chainseal.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Incremental Git seals, the project chain and offline-safe hooks (client side).
 
 The server's protocol (see docs/how-sealing-works.md): send the commit's file list (paths and

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/cli.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """The `imprint` command: login, init, seal, check and verify."""
 
 from __future__ import annotations
@@ -65,7 +66,7 @@ HANDLING = {
 }
 
 WORKFLOW = """\
-# Added by `imprint init` — CodeImprint by Mudrika
+# Added by `imprint init` — CodeImprint
 #
 # Seals the code on pushes to main and on tags (the seal and its receipt are kept as a build
 # artifact), and checks pull requests against a reference Imprint on your CodeImprint server.
@@ -1856,8 +1857,8 @@ def cmd_verify(args) -> int:
 
 # -- parser --------------------------------------------------------------------------------
 def build_parser() -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser(prog="imprint", description="CodeImprint by Mudrika — seal and "
-                                "check your code with a CodeImprint server.")
+    p = argparse.ArgumentParser(prog="imprint", description="CodeImprint — seal and check "
+                                "your code with a CodeImprint server.")
     p.add_argument("--version", action="version", version=f"codeimprint {__version__}")
     sub = p.add_subparsers(dest="command", required=True)
 

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Where the client keeps the server URL and token, and how settings are resolved.
 
 Order: command-line flag, then environment (CODEIMPRINT_URL, CODEIMPRINT_TOKEN), then the

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/gitrepo.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Read a Git repository for incremental sealing: tree listings, blobs and commit links.
 
 Everything comes from `git` itself (ls-tree, cat-file, rev-parse, rev-list): the client

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/imprint_file.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Offline verification of .imprint files (docs/imprint-format.md).
 
 Checks only the public file format: canonical JSON, SHA-256 digest, optional Ed25519

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/linecount.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """The line count of a seal (docs/line-count.md): the size a project is priced by.
 
 Non-blank lines in the files Git tracks at the sealed commit, without binary, vendored and

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/ownership.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Ownership claims (ADR 0002, D4): build claim documents and verify a project's ownership
 listing.
 

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/project.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Choosing which files leave the machine, and packing them into a zip.
 
 Only source files the server reads are sent (Python in this release). Files ignored by

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/receipt.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Verify a seal receipt: digest, attestation, developer signatures, log inclusion, time.
 
 A receipt is what `POST /api/v1/seal` returns next to the Imprint (see
@@ -16,7 +17,7 @@ from .imprint_file import b64d, canonical
 
 # The development log's origin. Servers can run under another origin (CODEIMPRINT_LOG_ORIGIN),
 # so a checkpoint must carry its receipt's origin, and the live log must keep it.
-ORIGIN = "codeimprint.mudrika.io/log/v1"
+ORIGIN = "codeimprint.dev/log/v1"
 CLOCK_SKEW = timedelta(minutes=5)       # allowed between the server's and a TSA's clock
 CONFIRM_WITHIN = timedelta(hours=1)     # a TSA time further after the seal is reported
 AGREE_WITHIN = timedelta(hours=1)       # valid tokens of one subject further apart: FAIL

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/records.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Ownership records (receipt format 4): the public byte format, for verification only.
 
 A record's digest is SHA-256 of its canonical JSON document; its ID is a typed ID built from

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/timestamp.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Offline verification of RFC 3161 time-stamp tokens.
 
 A token from an independent time-stamping authority (TSA) proves that a hash existed no later

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/transparency.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Merkle proofs for the CodeImprint transparency log (RFC 6962 hashing, RFC 9162 proofs).
 
 Leaf hash = SHA-256(0x00 || leaf bytes); node hash = SHA-256(0x01 || left || right). These

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/trust.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Keys: the server's published attestation keys, and the developer's own signing key.
 
 Server keys are trusted on first use and then only ever extended: a later key set must keep

{codeimprint-0.5.0a11 → codeimprint-0.5.0a13}/src/codeimprint_cli/tsa_roots.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: Apache-2.0
 """Pinned root certificates of the time-stamping authorities the client trusts.
 
 A timestamp token counts only if its signer certificate chains to one of these roots

codeimprint-0.5.0a11/NOTICE

@@ -1,11 +0,0 @@
-CodeImprint client by Mudrika
-Copyright 2026 Mudrika
-
-Licensed under the Apache License, Version 2.0 (see LICENSE).
-
-This client calls a CodeImprint server. It contains no part of the IMP-1 engine, which is
-proprietary to Mudrika and is not covered by this licence.
-
-"Mudrika" and "CodeImprint" are trademarks of their owner. The Apache License does not grant
-permission to use these names except as required for reasonable and customary use in
-describing the origin of the work.