Promethix Trust Material / NuGet

Promethix Trust / Package Provenance

Promethix.Framework.Ado

Canonical source repository: PromethixLabs/Promethix.Framework.Ado. Canonical public package feed: nuget.org.

Release Records

Canonical Links

• NuGet package page
• Source repository
• Release workflow run
• GitHub attestations
• Reusable build workflow

Trust Notes

This package is not currently Promethix author-signed. Public trust relies on nuget.org repository signing, GitHub Actions provenance attestations, and checksums published with the package release.

What Is Stored Where?

• The trust site publishes the package trust model and discovery links.
• NuGet hosts the canonical public package distribution.
• GitHub hosts the source repository, release workflow history, and attestations.
• Package-specific checksums and SBOM artifacts should be consumed from the package's canonical release system.

Verification

Get-FileHash .\Promethix.Framework.Ado.2.1.0.nupkg -Algorithm SHA256

Confirm the computed value matches the checksum published alongside the canonical package release artifacts.

dotnet nuget verify .\Promethix.Framework.Ado.2.1.0.nupkg --all

Confirm the package metadata on nuget.org points to the canonical source repository and expected version.

gh attestation verify Promethix.Framework.Ado.2.1.0.nupkg ^
  --repo PromethixLabs/Promethix.Framework.Ado

GitHub attestations for this repository are discoverable from the repository attestation view.