From 64c26db2429e7174da9f28ab4bfaa2dbdf6277c7 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sat, 1 Aug 2026 14:12:01 -0700 Subject: [PATCH] chore(release): 0.8.0 Ships parse_tpmt_signature() / ParsedSignature and both TPMS_ATTEST framings so cmcp and ca2a can delete their copies instead of keeping three implementations of the same wire formats in step by hand. Both downstreams carried a byte-identical TPMT_SIGNATURE unwrap; the framing gap was one-sided, since this package accepted only the bare form that tpm2_quote -m writes. This release is what lets the downstream fix be a deletion rather than a third hand-rolled parser. Phase A1 of consolidating TEE verification here. No change to manifest signing or verification behaviour. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 4 ++++ python/pyproject.toml | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c21b2f1..7256c77 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to Agent Manifest are documented here. Format follows [Keep ## [Unreleased] +## [0.8.0] — 2026-08-01 + +Shares the `TPMT_SIGNATURE` parse and teaches the quote parser both attest framings, so cmcp and ca2a can delete their copies rather than keep three implementations of the same wire formats in step by hand. Phase A1 of consolidating TEE verification into this package. No change to manifest signing or verification behaviour. + ### Added **[SDK]** **`parse_tpmt_signature()` and `ParsedSignature` are now public**, so cmcp and ca2a can stop carrying a copy each. Both had byte-identical implementations of the `TPMT_SIGNATURE` unwrap that `tpm2_quote -s` and `tpm2-pytss`'s `signature.marshal()` produce, differing only in which exception they raised; cmcp's comment already named this as "the piece agent-manifest does not model". It raises `TpmVerificationError` rather than `ValueError`, so a downstream migrating off its own copy needs to widen its `except` clause. `struct.error` on a truncated buffer is now caught and re-raised as `TpmVerificationError`, which ca2a handled and cmcp did not. diff --git a/python/pyproject.toml b/python/pyproject.toml index bd93219..3d008b7 100644 --- a/python/pyproject.toml +++ b/python/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "agent-manifest" -version = "0.7.0" +version = "0.8.0" description = "Agent Manifest SDK — cryptographically anchor all 10 artifacts defining an AI agent at deployment" readme = "README.md" requires-python = ">=3.11"