The v1.3.0 git tag's pyQuARC/version.txt contains 1.2.8, so a consumer that pins the tag and verifies the runtime-reported version sees the code identity (the tag) and the self-reported version disagree.
Observed 2026-08-30 installing from git+https://github.com/NASA-IMPACT/pyQuARC@v1.3.0 under Python 3.11:
from pathlib import Path
import pyQuARC
print((Path(pyQuARC.__file__).parent / "version.txt").read_text()) # 1.2.8
Our attestation harness pins the tag and checks the self-reported version in every receipt, and this mismatch is exactly the kind of drift the check exists to catch, so it refused its first receipt until we documented the discrepancy. Bumping the file at tagging time, or deriving the version from package metadata, would let pinned consumers verify what they run.
Context: open-science-pillars/marketplace#22. Thanks!
The v1.3.0 git tag's
pyQuARC/version.txtcontains1.2.8, so a consumer that pins the tag and verifies the runtime-reported version sees the code identity (the tag) and the self-reported version disagree.Observed 2026-08-30 installing from
git+https://github.com/NASA-IMPACT/pyQuARC@v1.3.0under Python 3.11:Our attestation harness pins the tag and checks the self-reported version in every receipt, and this mismatch is exactly the kind of drift the check exists to catch, so it refused its first receipt until we documented the discrepancy. Bumping the file at tagging time, or deriving the version from package metadata, would let pinned consumers verify what they run.
Context: open-science-pillars/marketplace#22. Thanks!