src2sink 1.0.0__tar.gz → 1.0.2__tar.gz

{src2sink-1.0.0/src2sink.egg-info → src2sink-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: src2sink
-Version: 1.0.0
+Version: 1.0.2
 Summary: Cross-repository source-to-sink metabase for LLM-assisted SAST
 Author: Brett Crawley
 License-Expression: MIT
@@ -194,6 +194,24 @@ annotations with a stated reason rather than blanket rule exclusions.
 Publishing a version to PyPI: [`docs/releasing.md`](https://github.com/mimecast/src2sink/blob/main/docs/releasing.md).
 Known small gaps: [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/main/docs/todo.md).
 
+### Verifying a release
+
+Releases from 1.0.2 carry signed build provenance (SLSA Build L2) tying each
+artefact to the source commit, tag, and workflow run that produced it — so a file
+claiming to be src2sink can be checked rather than trusted:
+
+```sh
+# downloaded from the GitHub release
+gh attestation verify src2sink-1.0.2-py3-none-any.whl --repo mimecast/src2sink
+
+# installed from PyPI (PEP 740 attestation)
+python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.2-*.whl
+```
+
+1.0.0 and 1.0.1 predate this and have no provenance. What the claim does and does
+not cover — and the plan for Build L3 — is in
+[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md).
+
 > **Incremental behaviour:** each re-run compares the repo's current `git HEAD` SHA
 > against the SHA stored in the existing per-repo JSON. Repos that haven't changed are
 > skipped (`skip  group/name (unchanged)`); only changed repos are re-extracted.
@@ -351,5 +369,7 @@ Do not add public PyPI fallbacks.
 - [`docs/api-clients-json.md`](https://github.com/mimecast/src2sink/blob/main/docs/api-clients-json.md) — the internal-service binding file.
 - [`metabase-usage.md`](https://github.com/mimecast/src2sink/blob/main/metabase-usage.md) — using the output as LLM context.
 - [`docs/releasing.md`](https://github.com/mimecast/src2sink/blob/main/docs/releasing.md) — publishing a version to PyPI.
+- [`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md) — build-provenance plan (SLSA Build L2 → L3).
+- [`CHANGELOG.md`](https://github.com/mimecast/src2sink/blob/main/CHANGELOG.md) — what shipped in each version.
 - [`NEXT_STEPS.md`](https://github.com/mimecast/src2sink/blob/main/NEXT_STEPS.md) — roadmap · [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/main/docs/todo.md) — known small gaps.
 - `/ai-sast-scanner` skill — SAST prompt this metabase feeds.

{src2sink-1.0.0 → src2sink-1.0.2}/README.md

@@ -159,6 +159,24 @@ annotations with a stated reason rather than blanket rule exclusions.
 Publishing a version to PyPI: [`docs/releasing.md`](https://github.com/mimecast/src2sink/blob/main/docs/releasing.md).
 Known small gaps: [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/main/docs/todo.md).
 
+### Verifying a release
+
+Releases from 1.0.2 carry signed build provenance (SLSA Build L2) tying each
+artefact to the source commit, tag, and workflow run that produced it — so a file
+claiming to be src2sink can be checked rather than trusted:
+
+```sh
+# downloaded from the GitHub release
+gh attestation verify src2sink-1.0.2-py3-none-any.whl --repo mimecast/src2sink
+
+# installed from PyPI (PEP 740 attestation)
+python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.2-*.whl
+```
+
+1.0.0 and 1.0.1 predate this and have no provenance. What the claim does and does
+not cover — and the plan for Build L3 — is in
+[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md).
+
 > **Incremental behaviour:** each re-run compares the repo's current `git HEAD` SHA
 > against the SHA stored in the existing per-repo JSON. Repos that haven't changed are
 > skipped (`skip  group/name (unchanged)`); only changed repos are re-extracted.
@@ -316,5 +334,7 @@ Do not add public PyPI fallbacks.
 - [`docs/api-clients-json.md`](https://github.com/mimecast/src2sink/blob/main/docs/api-clients-json.md) — the internal-service binding file.
 - [`metabase-usage.md`](https://github.com/mimecast/src2sink/blob/main/metabase-usage.md) — using the output as LLM context.
 - [`docs/releasing.md`](https://github.com/mimecast/src2sink/blob/main/docs/releasing.md) — publishing a version to PyPI.
+- [`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md) — build-provenance plan (SLSA Build L2 → L3).
+- [`CHANGELOG.md`](https://github.com/mimecast/src2sink/blob/main/CHANGELOG.md) — what shipped in each version.
 - [`NEXT_STEPS.md`](https://github.com/mimecast/src2sink/blob/main/NEXT_STEPS.md) — roadmap · [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/main/docs/todo.md) — known small gaps.
 - `/ai-sast-scanner` skill — SAST prompt this metabase feeds.

{src2sink-1.0.0 → src2sink-1.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "src2sink"
-version = "1.0.0"
+version = "1.0.2"
 description = "Cross-repository source-to-sink metabase for LLM-assisted SAST"
 authors = [{ name = "Brett Crawley" }]
 readme = "README.md"

{src2sink-1.0.0 → src2sink-1.0.2/src2sink.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: src2sink
-Version: 1.0.0
+Version: 1.0.2
 Summary: Cross-repository source-to-sink metabase for LLM-assisted SAST
 Author: Brett Crawley
 License-Expression: MIT
@@ -194,6 +194,24 @@ annotations with a stated reason rather than blanket rule exclusions.
 Publishing a version to PyPI: [`docs/releasing.md`](https://github.com/mimecast/src2sink/blob/main/docs/releasing.md).
 Known small gaps: [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/main/docs/todo.md).
 
+### Verifying a release
+
+Releases from 1.0.2 carry signed build provenance (SLSA Build L2) tying each
+artefact to the source commit, tag, and workflow run that produced it — so a file
+claiming to be src2sink can be checked rather than trusted:
+
+```sh
+# downloaded from the GitHub release
+gh attestation verify src2sink-1.0.2-py3-none-any.whl --repo mimecast/src2sink
+
+# installed from PyPI (PEP 740 attestation)
+python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.2-*.whl
+```
+
+1.0.0 and 1.0.1 predate this and have no provenance. What the claim does and does
+not cover — and the plan for Build L3 — is in
+[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md).
+
 > **Incremental behaviour:** each re-run compares the repo's current `git HEAD` SHA
 > against the SHA stored in the existing per-repo JSON. Repos that haven't changed are
 > skipped (`skip  group/name (unchanged)`); only changed repos are re-extracted.
@@ -351,5 +369,7 @@ Do not add public PyPI fallbacks.
 - [`docs/api-clients-json.md`](https://github.com/mimecast/src2sink/blob/main/docs/api-clients-json.md) — the internal-service binding file.
 - [`metabase-usage.md`](https://github.com/mimecast/src2sink/blob/main/metabase-usage.md) — using the output as LLM context.
 - [`docs/releasing.md`](https://github.com/mimecast/src2sink/blob/main/docs/releasing.md) — publishing a version to PyPI.
+- [`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md) — build-provenance plan (SLSA Build L2 → L3).
+- [`CHANGELOG.md`](https://github.com/mimecast/src2sink/blob/main/CHANGELOG.md) — what shipped in each version.
 - [`NEXT_STEPS.md`](https://github.com/mimecast/src2sink/blob/main/NEXT_STEPS.md) — roadmap · [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/main/docs/todo.md) — known small gaps.
 - `/ai-sast-scanner` skill — SAST prompt this metabase feeds.