From 40e583777bbb6209fc3b4226e5860c2bc7b0a1dd Mon Sep 17 00:00:00 2001 From: forkless Date: Tue, 9 Jun 2026 23:47:03 +0200 Subject: [PATCH] move attestation note from release notes to governance doc, reword --- _release.md | 5 ++++- docs/GOVERNANCE.md | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/_release.md b/_release.md index 877d14a..64b7307 100644 --- a/_release.md +++ b/_release.md @@ -13,6 +13,9 @@ extract, and run. • Backup archives now preserve source file modification times — restored files keep their original dates instead of showing 1970-01-01 on Windows • Restore backup picker navigation no longer stops before migrated entries • Save folder input dialog pre-fills with the currently set path -• SLSA provenance attestation re-enabled +• SLSA provenance attestation (automatic for tagged releases) Builds: Linux (amd64) • Windows x64 + +For a full history of changes across all versions, see +[`CHANGELOG.md`](https://github.com/forkless/NotAlterra/blob/master/CHANGELOG.md). diff --git a/docs/GOVERNANCE.md b/docs/GOVERNANCE.md index b83dba5..dc4d310 100644 --- a/docs/GOVERNANCE.md +++ b/docs/GOVERNANCE.md @@ -77,6 +77,10 @@ welcome. Patience is appreciated. Kindness is non-negotiable. CI now creates releases as drafts — binaries are built and uploaded but not published. The maintainer tests the draft binaries before publishing. +> SLSA provenance attestation is generated automatically for every +> tagged release. The `.intoto.jsonl` file is included with the +> binaries. No configuration needed. + Before signing a release tag, the maintainer verifies: - [ ] Impact analysis completed — all call sites for new/changed functions identified and updated