You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Clarification requested: v2.13.0 release version verification
#871
I am conducting a read-only review of the v2.13.0 release before considering installation.
The release PR #833 states that the candidate wheel and source archive were built and validated, that installed-version checks passed, and that the published artifacts matched the validated local artifacts by SHA-256.
However, a version-verification record previously encountered during this review reportedly showed:
skillspector --version → SkillSpector v2.11.1
I have not been able to locate this literal output in the publicly rendered v2.13.0 release notes or the visible PR #833 validation summary. I therefore cannot yet establish the exact source or context of that output.
Could you please clarify the following?
Source of the version output: Does the v2.11.1 output belong to the v2.13.0 release process? If so, which workflow run, job step, commit, and artifact produced it?
Build provenance: Which exact commit was used to build the published wheel, skillspector-2.13.0-py3-none-any.whl? Was the installed-version check performed against that exact wheel?
Version verification: Could you provide the relevant unedited CI log excerpt or another reproducible record showing the artifact path and the output of skillspector --version?
I am not alleging that the release artifact is defective. The purpose of this request is to resolve a version-provenance discrepancy and establish a clear evidence trail before installation.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hello SkillSpector maintainers,
I am conducting a read-only review of the v2.13.0 release before considering installation.
The release PR #833 states that the candidate wheel and source archive were built and validated, that installed-version checks passed, and that the published artifacts matched the validated local artifacts by SHA-256.
However, a version-verification record previously encountered during this review reportedly showed:
skillspector --version→SkillSpector v2.11.1I have not been able to locate this literal output in the publicly rendered v2.13.0 release notes or the visible PR #833 validation summary. I therefore cannot yet establish the exact source or context of that output.
Could you please clarify the following?
v2.11.1output belong to the v2.13.0 release process? If so, which workflow run, job step, commit, and artifact produced it?skillspector-2.13.0-py3-none-any.whl? Was the installed-version check performed against that exact wheel?skillspector --version?41e097b4127c0aa0732ad31cc909f8aee0b907d97816c866a55b8e782a6ca6dc, as recorded in PR release: prepare v2.13.0 security and blocking fixes #833.I am not alleging that the release artifact is defective. The purpose of this request is to resolve a version-provenance discrepancy and establish a clear evidence trail before installation.
References:
Thank you for clarifying this.
All reactions