audit-labs/evidence-seal

Tamper-evident seals and chain of custody for audit evidence.

clone: git clone https://gitbay.org/audit-labs/evidence-seal.git

bdab697b73d276102bae5c8623f0a8327291b6cd

verified · cmc

author: Christian Cleberg <hello@cleberg.net> · 2026-08-08T03:52:42Z

Release v1.0.0

Bump version to 1.0.0, add CHANGELOG, and document the stability commitment.

 CHANGELOG.md              | 28 ++++++++++++++++++++++++++++
 README.md                 |  6 ++++++
 evidence_seal/__init__.py |  2 +-
 pyproject.toml            |  2 +-
 4 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..da00e0c
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
+to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-08-07
+
+First stable release. The `manifest.json` schema (`manifest_version`) and the CLI
+exit codes are now a committed contract: neither changes in a breaking way without
+a major-version bump.
+
+## [0.1.0] - 2026-08-06
+
+### Added
+
+- Tamper-evident seals and chain of custody: streaming SHA-256 with a path-bound
+  Merkle root over a directory, written to a canonical `manifest.json`.
+- Append-only seal chains via `previous`, with the `ignore` globs stored so
+  `verify` reuses them.
+- Optional ed25519 signing (`[sign]` extra) and RFC 3161 timestamping
+  (`[timestamp]` extra), including full TSA-signature verification with `--tsa-cert`.
+- CLI subcommands `seal`, `verify`, `chain`, `keygen`, `sign`; exit codes
+  0 (intact), 1 (tamper / broken / invalid signature), 2 (usage).
+- PyPI trusted-publishing release workflow.
+
+[1.0.0]: https://github.com/audit-labs/evidence-seal/releases/tag/v1.0.0
+[0.1.0]: https://github.com/audit-labs/evidence-seal/releases/tag/v0.1.0
diff --git a/README.md b/README.md
index cae5d1c..284ff5d 100644
--- a/README.md
+++ b/README.md
@@ -181,6 +181,12 @@ Further limits to be honest about:
   to a trusted root — supply a TSA certificate you already trust.
 - Private keys are written **unencrypted** — store them accordingly.
 
+## Stability
+
+`evidence-seal` is stable as of **v1.0.0** and follows [semantic versioning](https://semver.org).
+The `manifest.json` schema (`manifest_version`) and the CLI exit codes are a
+committed contract — neither changes in a breaking way without a major-version bump.
+
 ## Development
 
 ```bash
diff --git a/evidence_seal/__init__.py b/evidence_seal/__init__.py
index 22a43ba..5aef438 100644
--- a/evidence_seal/__init__.py
+++ b/evidence_seal/__init__.py
@@ -1,6 +1,6 @@
 """evidence-seal — tamper-evident seals for audit evidence packages."""
 
-__version__ = "0.1.0"
+__version__ = "1.0.0"
 
 # Hash algorithm and manifest format version. Bump MANIFEST_VERSION only on a
 # breaking change to the manifest schema so verify can refuse the unknown.
diff --git a/pyproject.toml b/pyproject.toml
index 06a1178..2bade25 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "evidence-seal"
-version = "0.1.0"
+version = "1.0.0"
 description = "Tamper-evident seals and chain of custody for audit evidence packages."
 readme = "README.md"
 requires-python = ">=3.10"