packslip 1.1.0

A vendor-neutral signed release manifest: what shipped, and how to verify it
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

{
  "subject": [{
    "name": "mytool-1.2.3.tar.gz",
    "digest": { "sha256": "..." }
  }],
  "predicateType": "https://packslip.dev/release/v1",
  "predicate": {
    "project": "mytool.example.com",
    "version": "1.2.3",
    "artifacts": [{
      "name": "mytool-1.2.3.tar.gz",
      "url": "https://mytool.example.com/releases/1.2.3/mytool-1.2.3.tar.gz",
      "format": "tar.gz",
      "bin": ["bin/mytool"]
    }]
  }
}