{"schema":"skein.envelope/v1","address":"sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e","kind":"folio","stability":"stable","as_of":null,"body":{"type":"finding","title":"interskein 0.2.0 signed install specification","content":"# interskein 0.2.0 install specification\n\nDistribution: `interskein`\nVersion: `0.2.0`\nSource commit: `44d198251f5d8048442140dedc95022c3dd9df12`\nSource audit URL: `https://github.com/spiritengine/skein/commit/44d198251f5d8048442140dedc95022c3dd9df12`\nPyPI release: `https://pypi.org/project/interskein/0.2.0/`\n\nThe source commit is audit information for this first release, not a wheel-to-source provenance attestation.\n\n## PyPI artifacts\n\n`interskein-0.2.0-py3-none-any.whl`\nSHA256 `1103a18cb1ee4e459c7e589a903ad33d807d8194bd038d470e007915b15b7d54`\n\n`interskein-0.2.0.tar.gz`\nSHA256 `425f65879fb9d36004d6c17eda6b7608e8271694705aabf0d077983a5b860703`\n\nTrusted collaborator installation is wheel-only. The sdist hash is recorded for release audit and is not an allowed collaborator install artifact.\n\n## Bootstrap files\n\nBase URL: `https://interskein.com/onboarding`\n\n`sigstore-pinned.txt`\nSHA256 `38c2c0854765373e5de5cb9d8b960666d0e911bbc4baeb26f8198cf7213021da`\nBundle SHA256 `68fd27338dd1860d097ca4fd15ade00f2448054cd36827475149662eb6a16ba1`\nRekor index `2207058825`\n\n`interskein-pinned.txt`\nSHA256 `118f54ecec49f63e003e207528b151b384fb438a4be96687b8b380b18e38c3af`\nBundle SHA256 `b72bcbc811a26112707d6a3e29e169740c094d7cf5b2b1efb0f384800f4dfec8`\nRekor index `2207062769`\n\n`interskein-primer.txt`\nSHA256 `ddf1ac68acac6f1660f5247cbd4c25d4a76486491713170cfebcb87b7586180f`\nBundle SHA256 `4f21e97fea0b2a4fdc622b33c36c95950ae2e72e9db907d29541da1adc87dbd5`\nRekor index `2207063739`\n\nEach raw file has an adjacent `.sigstore.json` bundle.\n\n## Signing identity\n\nCertificate subject: `patricksmyth01@gmail.com`\nCertificate OIDC issuer: `https://accounts.google.com`\n\nAll three raw-file/bundle pairs were verified offline against that exact identity with Sigstore 4.3.0 after signing. Any other identity or any nonzero verification result is a hard stop.\n\n## Installation requirements\n\nInstall `sigstore-pinned.txt` first using the fixed PyPI index, `--require-hashes`, and `--only-binary=:all:`. Verify all three raw files with their bundles before installing `interskein-pinned.txt` with the same fixed-index, hashed, wheel-only restrictions. Confirm the installed distribution with `importlib.metadata.version(\"interskein\")`; this release intentionally provides `skein` and `mesh`, and no `interskein` console command.\n\nThe exact PyPI-only procedure was verified in a fresh virtual environment after upload. It installed `interskein 0.2.0`, `sigstore 4.3.0`, and `cryptography 46.0.7`; `pip check`, `skein --help`, and `mesh --help` passed.","created_at":"2026-07-20T17:42:20.562710+00:00","created_by":"whisker-0720"},"proof":{"profile":"skein.folio.canon/v1","content_hash":"sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e","signature_bundle":{"identity_scheme":"sigstore-public-v1","bundles":["{\"mediaType\":\"application/vnd.dev.sigstore.bundle.v0.3+json\",\"verificationMaterial\":{\"certificate\":{\"rawBytes\":\"MIIDLDCCArOgAwIBAgIUeOmo2W+c9ru/CYgZ+uMPJY5nmJwwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYwNzIwMTc0NTMxWhcNMjYwNzIwMTc1NTMxWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEl3Ju7xWaA0wn2vSievf55B7AUm23ltNRqg8bWh6ohVInxa9pwPTzNZW1H0b8T4xP/BI0gAHXZBiSM4F6UN2Fr6OCAdIwggHOMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUb/+XzRN4YTiSmcYeJkhOfOXVFv0wHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wJgYDVR0RAQH/BBwwGoEYcGF0cmlja3NteXRoMDFAZ21haWwuY29tMCkGCisGAQQBg78wAQEEG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTArBgorBgEEAYO/MAEIBB0MG2h0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbTBbBgorBgEEAYO/MAEYBE0MS0NoVXhNRGd3T0RrMk5qTXhORGMxTURNeE1UVXlNakFTSDJoMGRIQnpPaVV5UmlVeVJtRmpZMjkxYm5SekxtZHZiMmRzWlM1amIyMDCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABn4CiC5gAAAQDAEYwRAIgLfy6DOztAVfYsmINLolFCvS2SqQjDKUEWHhjhkY46Z8CIBVZG+dNmHMmi6+TvXD2uiwMdl85Zg90lQPoJlte6/q9MAoGCCqGSM49BAMDA2cAMGQCMA5CAdfWM3v3u0RIxmC9tfDRknLqueC1Xk6ZpQaPWV568Lnh2pcv6A7cmfGs2ttaPAIwZviATBM72zcDt5kBx4aBZxTvyj60om7pYVj7gJeg43j9/OEkbdHzDRBMsYZXaQGr\"},\"tlogEntries\":[{\"logIndex\":\"2207068907\",\"logId\":{\"keyId\":\"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=\"},\"kindVersion\":{\"kind\":\"hashedrekord\",\"version\":\"0.0.1\"},\"integratedTime\":\"1784569531\",\"inclusionPromise\":{\"signedEntryTimestamp\":\"MEUCIBrVpOxHQ4k0PnBoUHm3e7/kQbwO76bl1AG4L3UVcgj8AiEArR5J+HasQsKwaon5Db0I7Fs52atap/nxNzKpkMPJ0X0=\"},\"inclusionProof\":{\"logIndex\":\"2085164645\",\"rootHash\":\"H92DQhBjPM0RML7DaCUcXq34vfh3D7nY1DFCh8mXBoU=\",\"treeSize\":\"2085164647\",\"hashes\":[\"N7/fUyoE59cV3CH2vFwm4WdjZf3qpQKQicRW8YYQtSU=\",\"FK7FBSbwtEoKGiysu+dNMCfqK/BWx84/CJ9S/JDRe90=\",\"O/4mRWlk6EOfDBhobz3UrIXFWRGr44u12elXPThPYEA=\",\"MHgl8ndEb0R+K1XAsqDGV5CWuSOYhQ9q9IqoUMAG/Zg=\",\"6rN8pQSI6x34A+zM0puIQuN4ZMX5IYjg9Tbl0uUAhyc=\",\"2pnlQ5uqJIQ44jRHS/sqO1USu4EhN4VHImcXzCiu8Xw=\",\"ZTuMR2yPfC0RrhYVwAf2U1OVJURCxNQYSaLRmX4N2sE=\",\"lhiInOqTO7uBK3lWlCRFicuBOJd+qIp1k/B2SkL1ak4=\",\"p1E0fUDv5tItHoI/7+7Y6LQ1zGDq+5kmc/OUNiJBVBg=\",\"gwWIsSkuAZ4lN6rZebz9ixMHFcyOIJOpAbrvn0G7lN0=\",\"ssdaX3RCkDbbm0uSfkCYcXCxek9E9WFeYl3AI0nmk8I=\",\"GxT6+CEXxY8Ak/besnRW/IK3DhneHQ5X5rIcw8L01DQ=\",\"Rq/A2aTC9e54ldNjcpsJ26rX/h8JlN6ZHxgw7yEa6C0=\",\"+/VZ56MsIPxMiyLAodzKXo5TEWdQp36z89qLhpzloAo=\",\"daxmZaajRpZV+JxHiOYZhJBiSKN5ucqjh2WnGbHhirw=\",\"DOCeoSMovIvLExkhIvisow9AuNXgeWs4ECkyR6EcqYU=\"],\"checkpoint\":{\"envelope\":\"rekor.sigstore.dev - 1193050959916656506\\n2085164647\\nH92DQhBjPM0RML7DaCUcXq34vfh3D7nY1DFCh8mXBoU=\\n\\n— rekor.sigstore.dev wNI9ajBGAiEAkDY9KtHx1B8OWOFQ6FTPryOPls5dUV8YLie2t3Qr0EMCIQCPPO4am31JGnE+JLFR/5DoHv6l+Z823woBRBJKqkX8rg==\\n\"}},\"canonicalizedBody\":\"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyNWFlOTM0NzNlNmFlOTE0NWIyN2QwMWEyNGExNDZlM2RmMjU4ZDBjZDJhNjA0N2M0ODY3MTQ0ZjIyNjE1NzdiIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJRXpkMlQvQmN0bVBwQlNqRDdsYi9rM1FIaTlsc3YyaEF0N0lRMkkzY0JWc0FpQW1kVUJYdjIvQUk4eGJvdWpocVJVaHQ4aUZ4TTVJWk1VNVZ1R3phOEdiMVE9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUk1SRU5EUVhKUFowRjNTVUpCWjBsVlpVOXRiekpYSzJNNWNuVXZRMWxuV2l0MVRWQktXVFZ1YlVwM2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDU2U1hkTlZHTXdUbFJOZUZkb1kwNU5hbGwzVG5wSmQwMVVZekZPVkUxNFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZzTTBwMU4zaFhZVUV3ZDI0eWRsTnBaWFptTlRWQ04wRlZiVEl6YkhST1VuRm5PR0lLVjJnMmIyaFdTVzU0WVRsd2QxQlVlazVhVnpGSU1HSTRWRFI0VUM5Q1NUQm5RVWhZV2tKcFUwMDBSalpWVGpKR2NqWlBRMEZrU1hkblowaFBUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZpTHl0WUNucFNUalJaVkdsVGJXTlpaVXByYUU5bVQxaFdSbll3ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBwbldVUldVakJTUVZGSUwwSkNkM2RIYjBWWlkwZEdNR050YkdwaE0wNTBaVmhTYjAxRVJrRmFNakZvWVZkM2RWa3lPWFJOUTJ0SFEybHpSd3BCVVZGQ1p6YzRkMEZSUlVWSE1tZ3daRWhDZWs5cE9IWlpWMDVxWWpOV2RXUklUWFZhTWpsMldqSjRiRXh0VG5aaVZFRnlRbWR2Y2tKblJVVkJXVTh2Q2sxQlJVbENRakJOUnpKb01HUklRbnBQYVRoMldWZE9hbUl6Vm5Wa1NFMTFXakk1ZGxveWVHeE1iVTUyWWxSQ1lrSm5iM0pDWjBWRlFWbFBMMDFCUlZrS1FrVXdUVk13VG05V1dHaE9Va2RrTTFRd1VuSk5helZ4VkZob1QxSkhUWGhVVlZKT1pVVXhWVlpZYkU1aGEwWlVVMFJLYjAxSFVrbFJibkJRWVZaV05RcFZiV3hXWlZaS2RGSnRjRnBOYW10NFdXMDFVMlZyZUhSYVNGcHBUVzFTZWxkc1RURmhiVWw1VFVSRFFtbFJXVXRMZDFsQ1FrRklWMlZSU1VWQloxSTNDa0pJYTBGa2QwSXhRVTR3T1UxSGNrZDRlRVY1V1hoclpVaEtiRzVPZDB0cFUydzJORE5xZVhRdk5HVkxZMjlCZGt0bE5rOUJRVUZDYmpSRGFVTTFaMEVLUVVGUlJFRkZXWGRTUVVsblRHWjVOa1JQZW5SQlZtWlpjMjFKVGt4dmJFWkRkbE15VTNGUmFrUkxWVVZYU0docWFHdFpORFphT0VOSlFsWmFSeXRrVGdwdFNFMXRhVFlyVkhaWVJESjFhWGROWkd3NE5WcG5PVEJzVVZCdlNteDBaVFl2Y1RsTlFXOUhRME54UjFOTk5EbENRVTFFUVRKalFVMUhVVU5OUVRWRENrRmtabGROTTNZemRUQlNTWGh0UXpsMFprUlNhMjVNY1hWbFF6RllhelphY0ZGaFVGZFdOVFk0VEc1b01uQmpkalpCTjJOdFprZHpNblIwWVZCQlNYY0tXblpwUVZSQ1RUY3llbU5FZERWclFuZzBZVUphZUZSMmVXbzJNRzl0TjNCWlZtbzNaMHBsWnpRemFqa3ZUMFZyWW1SSWVrUlNRazF6V1ZwWVlWRkhjZ290TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0=\"}],\"timestampVerificationData\":{\"rfc3161Timestamps\":[{\"signedTimestamp\":\"MIIE6jADAgEAMIIE4QYJKoZIhvcNAQcCoIIE0jCCBM4CAQMxDTALBglghkgBZQMEAgEwgcIGCyqGSIb3DQEJEAEEoIGyBIGvMIGsAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgvim0iT/0L37y61YGO4q7F3w+1xw/TciQLexOoyOFaC8CFGKBdNWxy2TYDo3RulRZmkWRSRwJGA8yMDI2MDcyMDE3NDUzMVowAwIBAQIJAPVb9pywhTlZoDKkMDAuMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxFTATBgNVBAMTDHNpZ3N0b3JlLXRzYaCCAhQwggIQMIIBlqADAgECAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDAKBggqhkjOPQQDAzA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkMB4XDTI1MDQwODA2NTk0M1oXDTM1MDQwNjA2NTk0M1owLjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MRUwEwYDVQQDEwxzaWdzdG9yZS10c2EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATitrZnyEo2KDZP2QWMIBOgYbfSOTL5ZC/cHMv6Yq+HVIo1H9TC7Cx80KDiyvKhgB3wTqKyi9UDczhqg12b1AOLnRnydMTK+qB8M+1MjBci1+Jb8AV/VXu7CRuQCiPTHFyjajBoMA4GA1UdDwEB/wQEAwIHgDAdBgNVHQ4EFgQUif15Q4fP0GVGwwJGxyxzW3206wMwHwYDVR0jBBgwFoAUmOwB73+7Uf/UlR5vioiYUweJzr8wFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwCgYIKoZIzj0EAwMDaAAwZQIwO2mxX/opo7SrIX9QyxfZpJRcpAV2gZOm1AZzR+2rVyy6Uc8Ybp2ybIw13ckH4bcRAjEA5qO8FyOkmYpvg2/7ZNqiPxRzn5vqKHoVcIIqtpKq6l7TvOqzAxxclN7VwTG8e++XMYIB2zCCAdcCAQEwUTA5MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIDAeBgNVBAMTF3NpZ3N0b3JlLXRzYS1zZWxmc2lnbmVkAhQ6E1QvDJBh7rzBQy/Lio6LKiOLDDALBglghkgBZQMEAgGggfwwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjA3MjAxNzQ1MzFaMC8GCSqGSIb3DQEJBDEiBCCg2r+trGQMRiQb2prz7/PlKsqhSZqfcaSDHoYdUy9MiDCBjgYLKoZIhvcNAQkQAi8xfzB9MHsweQQghfknvAerYsrDtENWwQ78gbLGiD/aernm2HDZ0TrNBbcwVTA9pDswOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZAIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwIEZzBlAjBTIQhUck+eW3Xr0chpnd9BYPBO8fhmH1G3PXJZjOtCHitngsG1uAe/SbZ0ahUGOfcCMQC8JGVX5EHfsU4E4sAsxL7xHIZcXmFxQ2pbONesxNf2OWyz0ddgwQJ8EvZ+QgHUMxg=\"}]}},\"messageSignature\":{\"messageDigest\":{\"algorithm\":\"SHA2_256\",\"digest\":\"Ja6TRz5q6RRbJ9AaJKFG498ljQzSpgR8SGcUTyJhV3s=\"},\"signature\":\"MEQCIEzd2T/BctmPpBSjD7lb/k3QHi9lsv2hAt7IQ2I3cBVsAiAmdUBXv2/AI8xboujhqRUht8iFxM5IZMU5VuGza8Gb1Q==\"}}"],"canonical_bytes":"c2tlaW4ubWFuaWZlc3QuY2Fub24vdjEAeyJsZWFmX2NvdW50IjoxLCJyb290Ijoic2hhMjU2OjphNjhiOTNiNDBmYWMwNTdkYmM1MTQ0NTg3ZjYyMTFjNDA5NDZiOGFmY2JlYTY3Zjg3ZTQ3ZjA3NDM3NTA1NTIxIn0=","canon_version":"skein.manifest.canon/v1","trust_root_pin":null},"manifest":{"descriptor":{"leaf_count":1,"root":"sha256::a68b93b40fac057dbc5144587f6211c40946b8afcbea67f87e47f07437505521"},"leaf_list":["sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e"]}},"asserted":{"verdict":"SIGNED — patricksmyth01@gmail.com (verified)","signer":{"issuer":"https://accounts.google.com","subject":"patricksmyth01@gmail.com"},"status":"open","site":null,"threads_out":[],"threads_in":[],"lineage":{"parents":[],"children":[],"siblings":[]},"superseded_by":null,"descendants":[]},"links":{"self":"/folio/sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e","markdown":"/folio/sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e.md","json":"/folio/sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e.json","catalog":"/","bundle":"/folio/sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e/bundle"},"next":null}