tree 1cb216b8c510b079ea0849bca255c8d5c66dbfff parent f122927c972fb2a5c7a4c57f0d4c98a442205aaf author Alina Schanz 1788873740 +0200 committer Alina Schanz 1788873740 +0200 gpgsig -----BEGIN PGP SIGNATURE----- iJAEABYKADkWIQQXukw5NFGlaze47bvxpkdLQx3zqwUCaqAMDBsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDEACgkQ8aZHS0Md86tURgD4xhsplqSpbL+OqBb+JGdo D05bXmAPfuTCgB8Lbz1tuQEA9EC3ydVJhuBHEjrhRLR/kNvOMTy/Q6Rls0lVgyHl 6AY= =ad89 -----END PGP SIGNATURE----- release: checksums, an opentimestamps proof and a build provenance attestation on every release; the openssf scorecard release.yml now writes SHA256SUMS next to the sdist and the wheel, stamps it with opentimestamps (the proof is attached as it is; it completes on its own once a bitcoin block includes the calendar's root) and asks github for a build provenance attestation of both files. scorecard.yml runs the openssf scorecard weekly and on pushes to main and publishes the result; the readme carries the badge and a "verify a release" section with the three commands.