Release artifact verification¶

Status: Available. How to verify what a tagged ETLantic release actually published. Do not assume every release includes a CycloneDX SBOM.

Release artifact contract for v0.41.0¶

Artifact	Status
PyPI wheels/sdists for core and official packages	Expected after the tag workflow succeeds (`etlantic==0.41.0`, matching plugins)
Per-artifact SHA-256 manifest	Expected as release-artifacts.json
GitHub build provenance attestations	Generated by the release workflow; verify against the published artifacts
CycloneDX environment SBOM	Optional; the release includes either `etlantic-environment.cdx.json` or `sbom-warning.txt`

Do not record “SPDX SBOM digest” for the SHA-256 manifest. Digests are checksums of published wheels/sdists, not an SBOM document.

After publication, download the wheel (or sdist) and release-artifacts.json from the GitHub Release.
Confirm the file’s SHA-256 matches the manifest entry for that basename.
Prefer exact pins (etlantic==0.41.0) in lockfiles.

gh attestation verify path/to/etlantic-0.41.0-*.whl \
  --owner eddiethedean \
  --repo etlantic

Before announcing a release as installable:

Confirm PyPI serves the tagged version for core and official plugins.
Confirm GitHub Release assets include digests (and SBOM or sbom-warning.txt).
Confirm docs Installation / Quickstart pin that version (no git+…@main day-0 path).
Confirm enterprise/supply-chain pages match the actual assets.
Only then update README badges / public announcement copy.