Provenance verification now checks the published tarball bytes (
ae82096)
The publish flow now records the SHA-256 of the uploaded tarball, and the provenance endpoint compares an attestation’s subject.digest.sha256 against that stored hash instead of trusting package name/version alone. That closes a gap where a valid attestation could be bound to the wrong bytes, and verification now fails closed if no publish-time hash is available.
Other misc changes
- DB migration to add nullable
publishing_tasks.tarball_hash - SQLx query metadata updates for reading/writing tarball hashes
- Frontend asset/style updates