Skip to content

Pin dkg-hello-world commit to the v0.1.0 release SHA#2

Open
branarakic wants to merge 1 commit intomainfrom
pin/hello-world-v0.1.0
Open

Pin dkg-hello-world commit to the v0.1.0 release SHA#2
branarakic wants to merge 1 commit intomainfrom
pin/hello-world-v0.1.0

Conversation

@branarakic
Copy link
Copy Markdown
Contributor

Summary

The entry previously pinned `cb6af61` (the commit that added the publish workflow). The actual `@origintrail-official/dkg-hello-world@0.1.0` artifact on npm was built from `aa0a3c2` — the merge commit of the scope rename (`OriginTrail/dkg-hello-world#1`) and the ref tagged as `v0.1.0`.

This PR updates the pin so the registry entry points at the exact source commit that produced the published, provenance-attested tarball. Now the audit trail is fully consistent:

  • Registry entry `commit` → `aa0a3c2`
  • Git tag `v0.1.0` → `aa0a3c2`
  • SLSA provenance attestation subject → `aa0a3c2`

Change

```diff

  • "commit": "cb6af61a26b31be12ca9ff55a72af7442afe9c6b",
  • "commit": "aa0a3c28431723a986797ea040901eb3e75d4cf3",
    ```

Verification

Made with Cursor

The entry previously pinned cb6af61 (the commit that added the publish
workflow). The actual @origintrail-official/dkg-hello-world@0.1.0
artifact on npm was built from aa0a3c2, which is the merge commit of
the scope rename (OriginTrail/dkg-hello-world#1) and the ref tagged
as v0.1.0.

Update the pin so the registry entry points at the exact source commit
that produced the published, provenance-attested tarball.

Verification:
  https://www.npmjs.com/package/@origintrail-official/dkg-hello-world/v/0.1.0
  Attestation → Source commit: aa0a3c28431723a986797ea040901eb3e75d4cf3

Made-with: Cursor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant