Verify with [`sigstore-python`](https://github.com/sigstore/sigstore-python/):
bash
Download the release wheel and .sigstore file.
wget https://github.com/pywemo/pywemo/releases/download/1.4.0/pywemo-1.4.0-py3-none-any.whl
wget https://github.com/pywemo/pywemo/releases/download/1.4.0/pywemo-1.4.0-py3-none-any.whl.sigstore
Install sigstore: https://github.com/sigstore/sigstore-python#installation
python -m pip install sigstore
Verify that the wheel was built from this release.
python -m sigstore verify github \
--bundle pywemo-1.4.0-py3-none-any.whl.sigstore \
--cert-identity https://github.com/pywemo/pywemo/.github/workflows/publish.ymlrefs/tags/1.4.0 \
--sha 9a24c3e76a198a62968c3e6fa3c528e52a157797 \
pywemo-1.4.0-py3-none-any.whl
</details>
<details id="SLSA"><summary>How to verify <code>SLSA</code> provenance</summary>
<a href="https://slsa.dev/">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/slsa-framework/slsa/93cff4f95c07b095342ac256667594df038ad8d4/resources/assets/logo/horizontal/SVG/SLSA-logo-horizontal-white.svg">
<source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/slsa-framework/slsa/93cff4f95c07b095342ac256667594df038ad8d4/resources/assets/logo/horizontal/SVG/SLSA-logo-horizontal-original.svg">
<img alt="SLSA" src="https://raw.githubusercontent.com/slsa-framework/slsa/93cff4f95c07b095342ac256667594df038ad8d4/resources/assets/logo/horizontal/SVG/SLSA-logo-horizontal-original.svg" width="150">
</picture>
</a>
Visit [slsa.dev](https://slsa.dev/) to learn more about generating and verifying software provenance with SLSA.
SLSA verifier installation instructions can be found at [github.com/slsa-framework/slsa-verifierinstallation](https://github.com/slsa-framework/slsa-verifier#installation).
bash
Download the release wheel and .intoto.jsonl file.
wget https://github.com/pywemo/pywemo/releases/download/1.4.0/pywemo-1.4.0-py3-none-any.whl
wget https://github.com/pywemo/pywemo/releases/download/1.4.0/pywemo-1.4.0.intoto.jsonl
Verify that the wheel was built from this release.
slsa-verifier verify-artifact \
--provenance-path pywemo-1.4.0.intoto.jsonl \
--source-uri github.com/pywemo/pywemo \
--source-tag 1.4.0 \
pywemo-1.4.0-py3-none-any.whl
</details>