Status: stable design; first release in preparation — every claim on a release page must be independently verifiable with the commands below. Pending states are labeled pending; identifiers are never fabricated.

Provenance & Verification

Xtrape's public releases are designed to be verifiable without trusting any single hosting platform — including ours.

What every release publishes

Artifact	Purpose
Static site build and/or PDF	the human-readable baseline
Source archive	the exact source snapshot
SHA256SUMS	digests of all artifacts
provenance.json	machine-readable record binding tag, commit SHA, mirrors, digests, and identifiers
Sigstore bundle	signature + certificate + transparency-log inclusion proof for the artifacts
CITATION.cff, LICENSE, NOTICE	citation and legal metadata

Signature bundles are release assets, not just CI logs — a stable release is never backed by ephemeral evidence.

Verifying

1. Digests:

sha256sum -c SHA256SUMS

2. Sigstore signature (for each artifact, with its bundle):

cosign verify-blob \
  --bundle <artifact>.sigstore.json \
  --certificate-identity "<signer identity from provenance.json>" \
  --certificate-oidc-issuer "<issuer from provenance.json>" \
  <artifact>

Both the signer identity and the OIDC issuer are pinned: each release's provenance.json records the exact values to pass, and verification must bind both — never verify against a wildcard issuer. The transparency-log entry makes the signing time independently checkable.

3. Mirror consistency:

git ls-remote <canonical> --tags <tag>
git ls-remote <mirror> --tags <tag>

4. Independent archives:

• Zenodo — each published baseline is deposited with a version DOI (plus a concept DOI for the project); Zenodo records file digests independently. Deposits are made by CI as drafts and published only after human review of metadata and digests.
• Software Heritage — release tags trigger archival requests; the resulting snapshot/revision SWHID is recorded in the provenance index once archival completes. Until then a release honestly carries archive_status: pending — a SWHID is never fabricated.

Why this design

Time and content endorsement should not depend on any one platform's goodwill: digests bind content, Sigstore's transparency log binds time and signer, Zenodo binds a citable DOI with independent storage, and Software Heritage binds long-term archival — each verifiable separately. The Source page anchors where the code lives; this page anchors what was released and when.