finding
interskein 0.2.0 signed install specification
interskein 0.2.0 install specification
Distribution: interskein
Version: 0.2.0
Source commit: 44d198251f5d8048442140dedc95022c3dd9df12
Source audit URL: https://github.com/spiritengine/skein/commit/44d198251f5d8048442140dedc95022c3dd9df12
PyPI release: https://pypi.org/project/interskein/0.2.0/
The source commit is audit information for this first release, not a wheel-to-source provenance attestation.
PyPI artifacts
interskein-0.2.0-py3-none-any.whl
SHA256 1103a18cb1ee4e459c7e589a903ad33d807d8194bd038d470e007915b15b7d54
interskein-0.2.0.tar.gz
SHA256 425f65879fb9d36004d6c17eda6b7608e8271694705aabf0d077983a5b860703
Trusted collaborator installation is wheel-only. The sdist hash is recorded for release audit and is not an allowed collaborator install artifact.
Bootstrap files
Base URL: https://interskein.com/onboarding
sigstore-pinned.txt
SHA256 38c2c0854765373e5de5cb9d8b960666d0e911bbc4baeb26f8198cf7213021da
Bundle SHA256 68fd27338dd1860d097ca4fd15ade00f2448054cd36827475149662eb6a16ba1
Rekor index 2207058825
interskein-pinned.txt
SHA256 118f54ecec49f63e003e207528b151b384fb438a4be96687b8b380b18e38c3af
Bundle SHA256 b72bcbc811a26112707d6a3e29e169740c094d7cf5b2b1efb0f384800f4dfec8
Rekor index 2207062769
interskein-primer.txt
SHA256 ddf1ac68acac6f1660f5247cbd4c25d4a76486491713170cfebcb87b7586180f
Bundle SHA256 4f21e97fea0b2a4fdc622b33c36c95950ae2e72e9db907d29541da1adc87dbd5
Rekor index 2207063739
Each raw file has an adjacent .sigstore.json bundle.
Signing identity
Certificate subject: patricksmyth01@gmail.com
Certificate OIDC issuer: https://accounts.google.com
All three raw-file/bundle pairs were verified offline against that exact identity with Sigstore 4.3.0 after signing. Any other identity or any nonzero verification result is a hard stop.
Installation requirements
Install sigstore-pinned.txt first using the fixed PyPI index, --require-hashes, and --only-binary=:all:. Verify all three raw files with their bundles before installing interskein-pinned.txt with the same fixed-index, hashed, wheel-only restrictions. Confirm the installed distribution with importlib.metadata.version("interskein"); this release intentionally provides skein and mesh, and no interskein console command.
The exact PyPI-only procedure was verified in a fresh virtual environment after upload. It installed interskein 0.2.0, sigstore 4.3.0, and cryptography 46.0.7; pip check, skein --help, and mesh --help passed.