馃摑 docs(release): refresh release verification docs - #3330
Merged
gaborbernat merged 1 commit intoSep 26, 2026
Merged
Conversation
The verify-release how-to said the zipapp build does not pin what it bundles, which stopped being true when pypa#3306 added pylock.zipapp.toml, and the threat model still said wheels differ between build machines after pypa#3311. Neither page covered the release attestation GitHub signs for the immutable releases published since 21.11.0. Move the examples to 21.12.1, add gh release verify and verify-asset, and give a zipapp rebuild recipe that constrains the build tools from the SBOMs. Fix the same claims in the release artifacts reference, the explanation and the threat model, whose upgrade job note also named a deploy key that the workflow does not use.
gaborbernat
force-pushed
the
docs/release-verification-refresh
branch
from
September 26, 2026 16:30
baa2183 to
0b19229
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The release docs still said the zipapp build is unpinned (untrue since #3306) and that wheels differ between build machines (untrue since #3311), and they never covered the release attestation of immutable releases. 馃摑
verify-release.rstnow showsgh release verify/gh release verify-assetfor releases from 21.11.0 on and a byte-for-byte zipapp rebuild frompylock.zipapp.toml, with examples run against 21.12.1. The release artifacts reference, the explanation page and the threat model drop the same stale claims.