src2sink 1.0.2__tar.gz → 1.0.3__tar.gz

{src2sink-1.0.2/src2sink.egg-info → src2sink-1.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: src2sink
-Version: 1.0.2
+Version: 1.0.3
 Summary: Cross-repository source-to-sink metabase for LLM-assisted SAST
 Author: Brett Crawley
 License-Expression: MIT
@@ -196,21 +196,27 @@ Known small gaps: [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/mai
 
 ### Verifying a release
 
-Releases from 1.0.2 carry signed build provenance (SLSA Build L2) tying each
-artefact to the source commit, tag, and workflow run that produced it — so a file
-claiming to be src2sink can be checked rather than trusted:
+Releases carry signed build provenance tying each artefact to the source commit,
+tag, and workflow run that produced it — so a file claiming to be src2sink can be
+checked rather than trusted. From 1.0.3 the provenance is generated by an
+isolated builder (**SLSA Build L3**); 1.0.2 is L2; 1.0.0 and 1.0.1 have none.
 
 ```sh
-# downloaded from the GitHub release
-gh attestation verify src2sink-1.0.2-py3-none-any.whl --repo mimecast/src2sink
+# SLSA provenance, attached to the GitHub release (L3)
+slsa-verifier verify-artifact src2sink-1.0.3-py3-none-any.whl \
+  --provenance-path multiple.intoto.jsonl \
+  --source-uri github.com/mimecast/src2sink --source-tag v1.0.3
 
-# installed from PyPI (PEP 740 attestation)
-python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.2-*.whl
+# GitHub attestation, for the same artefact
+gh attestation verify src2sink-1.0.3-py3-none-any.whl --repo mimecast/src2sink
+
+# installed from PyPI instead (PEP 740 attestation)
+python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.3-*.whl
 ```
 
-1.0.0 and 1.0.1 predate this and have no provenance. What the claim does and does
-not cover — and the plan for Build L3 — is in
-[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md).
+What the claim does and does not cover is in
+[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md) —
+the Build track says nothing about dependencies or source trustworthiness.
 
 > **Incremental behaviour:** each re-run compares the repo's current `git HEAD` SHA
 > against the SHA stored in the existing per-repo JSON. Repos that haven't changed are

{src2sink-1.0.2 → src2sink-1.0.3}/README.md

@@ -161,21 +161,27 @@ Known small gaps: [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/mai
 
 ### Verifying a release
 
-Releases from 1.0.2 carry signed build provenance (SLSA Build L2) tying each
-artefact to the source commit, tag, and workflow run that produced it — so a file
-claiming to be src2sink can be checked rather than trusted:
+Releases carry signed build provenance tying each artefact to the source commit,
+tag, and workflow run that produced it — so a file claiming to be src2sink can be
+checked rather than trusted. From 1.0.3 the provenance is generated by an
+isolated builder (**SLSA Build L3**); 1.0.2 is L2; 1.0.0 and 1.0.1 have none.
 
 ```sh
-# downloaded from the GitHub release
-gh attestation verify src2sink-1.0.2-py3-none-any.whl --repo mimecast/src2sink
+# SLSA provenance, attached to the GitHub release (L3)
+slsa-verifier verify-artifact src2sink-1.0.3-py3-none-any.whl \
+  --provenance-path multiple.intoto.jsonl \
+  --source-uri github.com/mimecast/src2sink --source-tag v1.0.3
 
-# installed from PyPI (PEP 740 attestation)
-python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.2-*.whl
+# GitHub attestation, for the same artefact
+gh attestation verify src2sink-1.0.3-py3-none-any.whl --repo mimecast/src2sink
+
+# installed from PyPI instead (PEP 740 attestation)
+python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.3-*.whl
 ```
 
-1.0.0 and 1.0.1 predate this and have no provenance. What the claim does and does
-not cover — and the plan for Build L3 — is in
-[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md).
+What the claim does and does not cover is in
+[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md) —
+the Build track says nothing about dependencies or source trustworthiness.
 
 > **Incremental behaviour:** each re-run compares the repo's current `git HEAD` SHA
 > against the SHA stored in the existing per-repo JSON. Repos that haven't changed are

{src2sink-1.0.2 → src2sink-1.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "src2sink"
-version = "1.0.2"
+version = "1.0.3"
 description = "Cross-repository source-to-sink metabase for LLM-assisted SAST"
 authors = [{ name = "Brett Crawley" }]
 readme = "README.md"

{src2sink-1.0.2 → src2sink-1.0.3/src2sink.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: src2sink
-Version: 1.0.2
+Version: 1.0.3
 Summary: Cross-repository source-to-sink metabase for LLM-assisted SAST
 Author: Brett Crawley
 License-Expression: MIT
@@ -196,21 +196,27 @@ Known small gaps: [`docs/todo.md`](https://github.com/mimecast/src2sink/blob/mai
 
 ### Verifying a release
 
-Releases from 1.0.2 carry signed build provenance (SLSA Build L2) tying each
-artefact to the source commit, tag, and workflow run that produced it — so a file
-claiming to be src2sink can be checked rather than trusted:
+Releases carry signed build provenance tying each artefact to the source commit,
+tag, and workflow run that produced it — so a file claiming to be src2sink can be
+checked rather than trusted. From 1.0.3 the provenance is generated by an
+isolated builder (**SLSA Build L3**); 1.0.2 is L2; 1.0.0 and 1.0.1 have none.
 
 ```sh
-# downloaded from the GitHub release
-gh attestation verify src2sink-1.0.2-py3-none-any.whl --repo mimecast/src2sink
+# SLSA provenance, attached to the GitHub release (L3)
+slsa-verifier verify-artifact src2sink-1.0.3-py3-none-any.whl \
+  --provenance-path multiple.intoto.jsonl \
+  --source-uri github.com/mimecast/src2sink --source-tag v1.0.3
 
-# installed from PyPI (PEP 740 attestation)
-python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.2-*.whl
+# GitHub attestation, for the same artefact
+gh attestation verify src2sink-1.0.3-py3-none-any.whl --repo mimecast/src2sink
+
+# installed from PyPI instead (PEP 740 attestation)
+python -m pypi_attestations verify pypi --repo mimecast/src2sink src2sink-1.0.3-*.whl
 ```
 
-1.0.0 and 1.0.1 predate this and have no provenance. What the claim does and does
-not cover — and the plan for Build L3 — is in
-[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md).
+What the claim does and does not cover is in
+[`docs/slsa.md`](https://github.com/mimecast/src2sink/blob/main/docs/slsa.md) —
+the Build track says nothing about dependencies or source trustworthiness.
 
 > **Incremental behaviour:** each re-run compares the repo's current `git HEAD` SHA
 > against the SHA stored in the existing per-repo JSON. Repos that haven't changed are