Controls: REL-03, REL-08, REL-17, REL-20.
Register the PyPI Trusted Publisher and protected pypi environment, commit the approved tag-signer identity, cut the first signed annotated tag with a matching changelog section, and verify the full publish/SBOM/cosign/SLSA/download-verification path end to end.
Controls: REL-03, REL-08, REL-17, REL-20.
Register the PyPI Trusted Publisher and protected
pypienvironment, commit the approved tag-signer identity, cut the first signed annotated tag with a matching changelog section, and verify the full publish/SBOM/cosign/SLSA/download-verification path end to end.