chore(release): 0.28.0 - #109
Merged
Merged
Conversation
Cuts a clean release. Supersedes 0.26.0 and 0.27.0, whose sdists carry internal infrastructure identifiers in a test fixture; the wheels never did, and #107 removed them from the tree. Contents since 0.27.0: #105 public demos run against the wheel the branch would ship #106 protected-runtime evidence captured on real Azure SEV-SNP silicon #107 identifier redaction plus a CI leak scan on every push, PR and release 0.28.0 rather than 0.27.1: #106 is additive evidence work with a new test module, and #107 adds a workflow and a tool rather than only editing fixtures. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019kmhCCZYFS1ZzQjeoQWkw4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts a clean release so there is a current sdist on PyPI that carries no internal infrastructure identifiers.
Why now
The 0.26.0 and 0.27.0 sdists carry a subscription GUID, a resource group, a VM name and two device certificate serials in
tests/fixtures/live-validation/. The wheels never did, which is why most installs never saw them. #107 removed them from the tree; this puts a clean artifact on the index. Per the call on RCA-0008 this supersedes rather than yanks, so 0.26.0 and 0.27.0 stay downloadable.0.25.0 is not affected. Its
OPAQUE internalhits aretools/final_launch.pysetting the classification value and the matching test literal, not evidence.Contents since 0.27.0
0.28.0 rather than 0.27.1: #106 is additive evidence work with a new test module, and #107 adds a workflow and a tool rather than only editing fixtures.
Still open after this
paired-2026-08-20/paired-release.jsonkeeps an Azure SNP/vTPM device serial and the H100 model, driver, VBIOS and PCI address, allowlisted and marked OPEN. It is SHA-256 pinned bytest_paired_hardware_receipt.py, so redacting it breaks the pin that shows the receipt is the one the hardware produced. Evidentiary pinning against publishability is a judgement call, owner Imran. This release ships it unchanged, as 0.27.0 did.Verified
python tools/leak_scan.py: clean, 7 documented exceptions, exit 0__version__0.28.0, picked up by[tool.hatch.version]Publishing is triggered by cutting a GitHub Release, not by this merge.