diff --git a/evidence/releases/v1.7.0/GA_VERIFICATION.md b/evidence/releases/v1.7.0/GA_VERIFICATION.md new file mode 100644 index 0000000..3ed7eb1 --- /dev/null +++ b/evidence/releases/v1.7.0/GA_VERIFICATION.md @@ -0,0 +1,28 @@ +# v1.7.0 GA verification + +**Date:** 2026-07-13 +**Tag:** `v1.7.0` +**Commit:** `6af3119` +**Command:** `scripts/verify-ga-release.sh v1.7.0` + +## Result + +```text +final_status=PRODUCTION_GA_READY +ga_ready=True +production_ready=True +ga_blockers=[] +signing_verified=True +provenance_verified=True +real_repos=15/15 +``` + +## Steps + +1. Download all release assets for `v1.7.0` +2. `shasum -a 256 -c checksums.txt` → 12/12 OK +3. `cosign verify-blob` on checksums.txt → Verified OK +4. `gh attestation verify` on darwin_arm64 archive → exit 0 +5. `pkgsafe test production-readiness` with `PKGSAFE_RELEASE_ARTIFACT_DIR` → PRODUCTION_GA_READY + +Machine report: [production-readiness-ga.json](./production-readiness-ga.json) diff --git a/evidence/releases/v1.7.0/RELEASE_SUMMARY.md b/evidence/releases/v1.7.0/RELEASE_SUMMARY.md new file mode 100644 index 0000000..4b71c37 --- /dev/null +++ b/evidence/releases/v1.7.0/RELEASE_SUMMARY.md @@ -0,0 +1,68 @@ +# pkgsafe v1.7.0 — Production GA + +- **Tag:** `v1.7.0` (commit `6af3119`) +- **Published:** 2026-07-13 +- **GitHub:** https://github.com/sairintechnologycom/pkgsafe/releases/tag/v1.7.0 +- **Channel:** **Latest** (not a pre-release) +- **Release workflow:** https://github.com/sairintechnologycom/pkgsafe/actions/runs/29261919774 + (core publish succeeded; Homebrew tap push failed with PAT 403 — see caveats) + +## Classification + +```text +final_status: PRODUCTION_GA_READY +ga_ready: true +production_ready: true +ga_blockers: [] +``` + +Evidence: [production-readiness-ga.json](./production-readiness-ga.json) · [GA_VERIFICATION.md](./GA_VERIFICATION.md) + +## What shipped (since v1.6.0) + +- Scan fail-closed: `--mode block` / `--fail-on` exit 1 on BLOCK +- CI `--full` + `scan_coverage` (`full` / `changed_only` / `changed_only_empty`) +- production-readiness defaults to real-repo catalog (15/15) +- Install intercept: npm, **pnpm**, **yarn**, **uv**, pip, python -m pip +- Shell shims for npm/pnpm/yarn/pip/uv +- GA verify automation: `scripts/verify-ga-release.sh` + +## Verification ritual + +| Check | Result | +|---|---| +| Assets published (16) | PASS | +| Checksums 12/12 | PASS | +| Cosign verify-blob | PASS (Verified OK) | +| GitHub attestation | PASS | +| Binary `pkgsafe version` | `pkgsafe 1.7.0 (6af3119)` | +| `production-readiness` | **PRODUCTION_GA_READY** | +| Homebrew formula push | **FAIL** — tap token 403 | + +## Install + +```bash +# Latest stable +curl -fsSL https://github.com/sairintechnologycom/pkgsafe/releases/latest/download/install.sh | bash + +# Pin +VERSION=1.7.0 +curl -fsSL "https://github.com/sairintechnologycom/pkgsafe/releases/download/v${VERSION}/install.sh" | bash +``` + +Homebrew (once tap formula is updated manually): + +```bash +brew install sairintechnologycom/pkgsafe/pkgsafe +brew upgrade pkgsafe +``` + +## Caveats + +1. **Homebrew:** GoReleaser could not push `Formula/pkgsafe.rb` to + `sairintechnologycom/homebrew-pkgsafe` (`403 Resource not accessible by + personal access token`). Release binaries are on GitHub Releases; refresh + `HOMEBREW_TAP_TOKEN` with `contents:write` on the tap and re-run formula + publish, or push the formula manually. +2. Workflow job marked failed only because of the Homebrew step after assets + and signatures were already published. diff --git a/evidence/releases/v1.7.0/production-readiness-ga.json b/evidence/releases/v1.7.0/production-readiness-ga.json new file mode 100644 index 0000000..bef98b6 --- /dev/null +++ b/evidence/releases/v1.7.0/production-readiness-ga.json @@ -0,0 +1,200 @@ +{ + "generated_at": "2026-07-13T15:27:19Z", + "final_status": "PRODUCTION_GA_READY", + "current_stage": "PRODUCTION_GA_READY", + "recommendation": "PRODUCTION_GA_READY: all GA hardening gates verified.", + "pass": true, + "private_beta_ready": true, + "ga_ready": true, + "production_ready": true, + "online_benchmark_status": "pass", + "benchmark_candidate_eligible": true, + "benchmark_packages_configured": 25, + "benchmark_packages_executed": 25, + "benchmark_packages_skipped": 0, + "benchmark_coverage_ratio": 1, + "github_action_status": "valid", + "signed_release_status": "signed", + "signing_configured": true, + "signing_verified": true, + "sbom_status": "present", + "sbom_verified": true, + "checksums_status": "verified", + "checksums_verified": true, + "provenance_status": "verified", + "provenance_configured": true, + "provenance_verified": true, + "docs_status": "complete", + "real_repo_validation_count": 15, + "required_real_repo_validation_count": 15, + "repo_validation_pass_rate": 1, + "ecosystem_depth_status": "npm-ga-pypi-public-beta-go-cargo-preview", + "isolated_backend_status": "unavailable", + "isolated_backend_available": false, + "behavior_analysis_default_mode": "disabled", + "npm_repo_count": 12, + "pypi_repo_count": 4, + "go_repo_count": 0, + "cargo_repo_count": 0, + "false_block_count": 0, + "scanner_crash_count": 0, + "average_scan_duration_ms": 1, + "p95_scan_duration_ms": 3, + "average_scan_duration_us": 971, + "p95_scan_duration_us": 2098, + "scan_timing_trustworthy": true, + "scan_timing_floor_count": 12, + "critical_detection_rate": 1, + "known_good_false_block_rate": 0, + "private_beta_recommendation": true, + "gates": [ + { + "name": "rollout readiness", + "passed": true, + "blocking": true, + "duration_ms": 24990, + "summary": "PRIVATE_BETA_READY", + "details": [ + "GO for private beta rollout. Continue to keep lifecycle behavior analysis labelled best-effort." + ] + }, + { + "name": "benchmark validation", + "passed": true, + "blocking": true, + "duration_ms": 0, + "summary": "PRIVATE_BETA_ACCURACY_CANDIDATE", + "details": [ + "direct recall 100.00%", + "transitive recall 100.00%", + "source import recall 100.00%", + "packages configured=25 executed=25 skipped=0 coverage=100.00% candidate_eligible=true" + ] + }, + { + "name": "real repository evidence", + "passed": true, + "blocking": true, + "duration_ms": 0, + "summary": "real repository evidence threshold met", + "details": [ + "validated=15 required=15 passed=15 failed=0" + ] + }, + { + "name": "online benchmark", + "passed": true, + "blocking": false, + "duration_ms": 0, + "summary": "online benchmark: pass", + "details": [ + "mode=connected attempted=25 passed=25 failed=0 network_unavailable=0 registry_unavailable=0 package_not_found=0 scanner_failure=0 expectation_mismatch=0" + ] + }, + { + "name": "OSV cache", + "passed": true, + "blocking": true, + "duration_ms": 277, + "summary": "OSV database is initialized", + "details": [ + "records: 260056", + "path: /Users/bhushan/.pkgsafe/pkgsafe.db" + ] + }, + { + "name": "CI outputs", + "passed": true, + "blocking": true, + "duration_ms": 1, + "summary": "JSON, SARIF, and Markdown outputs generated", + "details": [ + "/var/folders/38/czrn5d6s5992dpmtjy_cn6rm0000gn/T/pkgsafe-ci-output-1408960400/results.json", + "/var/folders/38/czrn5d6s5992dpmtjy_cn6rm0000gn/T/pkgsafe-ci-output-1408960400/results.sarif", + "/var/folders/38/czrn5d6s5992dpmtjy_cn6rm0000gn/T/pkgsafe-ci-output-1408960400/summary.md" + ] + }, + { + "name": "documentation", + "passed": true, + "blocking": true, + "duration_ms": 0, + "summary": "production docs exist", + "details": [ + "README.md", + "SECURITY.md", + "docs/ci-cd.md", + "docs/github-action.md", + "docs/mcp-codex.md", + "docs/policy-guide.md", + "docs/private-registry.md", + "docs/known-limitations.md", + "docs/threat-model.md", + "docs/release-verification.md" + ] + }, + { + "name": "policy validation", + "passed": true, + "blocking": true, + "duration_ms": 0, + "summary": "default policy is valid", + "details": [ + "default-policy.yaml" + ] + }, + { + "name": "release artifacts", + "passed": true, + "blocking": false, + "duration_ms": 35, + "summary": "checksums and SBOM exist and checksums verify", + "details": [ + "/Users/bhushan/Documents/Projects/pkgsafe/dist/ga-verify/checksums.txt", + "/Users/bhushan/Documents/Projects/pkgsafe/dist/ga-verify/pkgsafe_1.7.0_darwin_amd64.tar.gz.sbom.json" + ] + }, + { + "name": "github action", + "passed": true, + "blocking": false, + "duration_ms": 0, + "summary": "composite action, entrypoint, and example workflow present", + "details": [ + "action.yml", + "scripts/github-action-entrypoint.sh", + ".github/workflows/pkgsafe-action-example.yml" + ] + }, + { + "name": "signed release", + "passed": true, + "blocking": false, + "duration_ms": 1524, + "summary": "cosign signature verified for checksums.txt", + "details": [ + "Flag --certificate has been deprecated, please use --bundle with --trusted-root to provide the public certificate\nFlag --signature has been deprecated, please use --bundle to provide a signature\nVerified OK" + ] + }, + { + "name": "sbom", + "passed": true, + "blocking": false, + "duration_ms": 0, + "summary": "SBOM present", + "details": [ + "/Users/bhushan/Documents/Projects/pkgsafe/dist/ga-verify/pkgsafe_1.7.0_darwin_amd64.tar.gz.sbom.json" + ] + }, + { + "name": "build provenance", + "passed": true, + "blocking": false, + "duration_ms": 12302, + "summary": "GitHub build provenance attestation verified", + "details": [ + "gh attestation verify succeeded" + ] + } + ] +}