From 5eee8f22a210428525881f9258a63ac8eaa15d9d Mon Sep 17 00:00:00 2001 From: Matthew Keeler Date: Thu, 22 Feb 2024 09:26:48 -0500 Subject: [PATCH] Automatically update version --- PROVENANCE.md | 2 ++ release-please-config.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/PROVENANCE.md b/PROVENANCE.md index 7002175f..149dcb37 100644 --- a/PROVENANCE.md +++ b/PROVENANCE.md @@ -6,6 +6,7 @@ As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0 To verify SLSA provenance attestations, we recommend using [slsa-verifier](https://github.com/slsa-framework/slsa-verifier). Example usage for verifying SDK packages is included below: + ``` # Download package from PyPi $ pip download --only-binary=:all: launchdarkly-server-sdk @@ -25,6 +26,7 @@ Verifying artifact launchdarkly_server_sdk-9.2.0-py3-none-any.whl: PASSED PASSED: Verified SLSA provenance ``` + Alternatively, to verify the provenance manually, the SLSA framework specifies [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation. diff --git a/release-please-config.json b/release-please-config.json index 90edd09a..90707565 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -4,7 +4,7 @@ "release-type": "python", "versioning": "default", "include-v-in-tag": false, - "extra-files": ["ldclient/version.py"], + "extra-files": ["ldclient/version.py", "PROVENANCE.md"], "include-component-in-tag": false } }