Release evidence

Current release checks

• Pass

  All-file integrity

  GNU/Linux: 183 tests passed, zero failed or skipped. New regressions cover linked source roots, output collisions, private instruction exclusions and report routes.

  python3 -m unittest discover -s tests -v
• Pass

  Hybrid authentication and history

  The complete 0.4.1 run exercised real OpenSSL 3.5.7 hybrid signatures, independent pins, history and checkpoint rejection tests. Runtime formats are preserved.

• Pass

  Private encrypted export

  Native Zupt 5.2.10 positive and negative tests passed. Restoration qualifies bytes; POSIX modes and ACLs are not restored.

• Pass

  Linux and Windows CI

  Release publication requires the exact final-source matrix: six Linux/Windows jobs on Python 3.10, 3.12 and 3.14. The final run is linked from the release; native optional providers have separate scope.

• Pass

  Portable checks

  Eleven isolated portable checks passed outside the source tree, including whole-file integrity and native hybrid authentication.

  python3 -I codemark.pyz self-test --json
• Pass

  Source review and static checks

  Focused release-tooling review and regressions; Ruff, formatting, Pyright and selected-diff secret screening passed. No independent external audit is claimed.

• Pass

  Website validation

  The documented release recipe passed strict link validation after download staging. Final generated links, download hashes and real-browser checks gate public activation.

  python3 scripts/build_site.py --output /tmp/secops-codemark-site-0.4.1 --check
• Pass

  Public release archive

  Publication requires a genuine unencrypted .zupt, zupt test, SHA-256 checksums and extracted-byte comparison against the annotated tag. Earlier artifacts are preserved.

  python3 scripts/build.py --output /tmp/secops-codemark-release-0.4.1 --archive

Reports and audits

Reports state their method, scope, and limitations. Read them alongside the measured results.