bce-engine@0.2.0 release verification#

bce-engine@0.2.0 was published on 2026-09-05 through the tag-gated release workflow. This page binds the registry artifact, source, provenance, and recovered release evidence without hiding the asset-ordering failure that occurred after npm publication.

Published identity#

The npm provenance subject is pkg:npm/bce-engine@0.2.0. It binds the package digest to .github/workflows/release.yml@refs/tags/v0.2.0, the Git commit above, and attempt 2 of the linked GitHub Actions run. The annotated Git tag is not claimed as a cryptographic signature; npm provenance and the Sigstore evidence bundle are the authenticated producer evidence.

Evidence assets#

The supplemental immutable release contains exactly these recovered assets:

The bundle was reconstructed from public Rekor entry 108e9186e8c5677a2a4ca6bb093fd4f840ee998feb75da9566762f5db8b73eebbf8a95abd5de72d3 and verified against both constraints used in the release workflow:

• certificate issuer: https://token.actions.githubusercontent.com;
• certificate identity: https://github.com/blueprint-conformance/bce/.github/workflows/release.yml@refs/tags/v0.2.0.

Incident and fix-forward#

The first publish attempt stopped before npm publication when the Sigstore client timed out while submitting to Rekor. The failed job was retried against the same already-pushed annotated tag and exact source commit. Attempt 2 generated and verified the evidence again, then published the npm package with provenance.

The old workflow next created the canonical GitHub Release as published. Repository immutability froze it immediately, so the following asset upload was rejected with HTTP 422. The canonical release is therefore immutable and intentionally has no assets. The package and v0.2.0 tag were not moved, deleted, or republished. Instead, the exact record retained in the run log, its Rekor-recovered bundle, and the deterministically regenerated compliance report were attached to the supplemental immutable evidence release at the same source commit.

PR #51 fixes future ceremonies: it stages and digest-checks every asset on a draft, publishes npm, then freezes the prepared GitHub Release in a separate retry-safe finalizer. GitHub's immutable-release documentation likewise requires assets to be uploaded before a draft is published.

Independent replay#

Registry identity can be checked without trusting this page:

npm view bce-engine@0.2.0 version dist.integrity dist.shasum dist.attestations
npm pack bce-engine@0.2.0
printf 'sha512-%s\n' "$(openssl dgst -sha512 -binary bce-engine-0.2.0.tgz | openssl base64 -A)"
shasum -a 1 bce-engine-0.2.0.tgz

After downloading the three evidence assets from the supplemental release, compare their SHA-256 values with the table and verify the bundle from a clean source checkout:

gh release download evidence-v0.2.0 --repo blueprint-conformance/bce
shasum -a 256 release-evidence-record.json release-evidence-record.sigstore release-compliance-report.json
npm ci
node node_modules/@sigstore/cli/bin/run verify \
  release-evidence-record.sigstore \
  --certificate-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-uri https://github.com/blueprint-conformance/bce/.github/workflows/release.yml@refs/tags/v0.2.0

This is release-supply-chain and deterministic-mechanism evidence. It is not independent adoption, private-product dogfood, or efficacy evidence, and it does not enter the sealed comparative-study outcome ledger.