)]}'
{
  "commit": "1df594373b77e68ca4edee7211ef2105ae6908c4",
  "tree": "bfffc136423462dc4dea38aa6dc90fb86b9cc0c4",
  "parents": [
    "9df389a76385f82c1165c7cf93b78807b5ea8890"
  ],
  "author": {
    "name": "Moritz",
    "email": "27859082+mosuem@users.noreply.github.com",
    "time": "Tue Oct 20 11:39:49 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Oct 20 09:39:49 2026 +0000"
  },
  "message": "Support uploading package attestations during publish --from-archive (#4876)\n\nAdds client support for publishing package attestations during `pub publish`:\n\n- Adds `--with-attestation \u003cbundle.sigstore.json\u003e` flag to `dart pub publish --from-archive`.\n- Enforces that a repository is specified in `pubspec.yaml` (`repository` field) when publishing with an attestation.\n- Validates that `--with-attestation` can only be used with `--from-archive`, and that the file is non-empty and contains a JSON object, before asking the user to confirm the publication.\n\n### Protocol\n\n`doc/repository-spec-v2.md` gets a new *Publishing with an Attestation* section:\n\n- A repository that supports publishing with attestations returns an `\u003cattestation-upload-url\u003e` in the `attestationUrl` property of the response from `\u003chosted-url\u003e/api/packages/versions/new`. A repository that does not support it simply omits the property.\n- The client `POST`s the bundle as `application/json` to `\u003cattestation-upload-url\u003e` **before** uploading the package archive, attaching `Authorization` under the same prefix rule as `archive_url`.\n- `\u003cfinalize-upload-url\u003e` remains a plain `GET`.\n\n`attestationUrl` is an opaque URL: a repository may point it at its own endpoint or at a signed URL on a storage service. On pub.dev it is an endpoint on the app server, so no second signed upload policy is needed (see dart-lang/pub-dev#9545).\n\nServer side: dart-lang/pub-dev#9545",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "592b0f88cd6e1a159326ac581fce58462259126b",
      "old_mode": 33188,
      "old_path": "doc/repository-spec-v2.md",
      "new_id": "05f276a4f78ca720367247348294d2b5dfae9162",
      "new_mode": 33188,
      "new_path": "doc/repository-spec-v2.md"
    },
    {
      "type": "modify",
      "old_id": "16ec749ec981114cbef7238d619576a7fce04162",
      "old_mode": 33188,
      "old_path": "lib/src/command/lish.dart",
      "new_id": "b97b4b5556cdf8cf861da565411339570f702880",
      "new_mode": 33188,
      "new_path": "lib/src/command/lish.dart"
    },
    {
      "type": "modify",
      "old_id": "85cd6d5feeb502947fdd4138c1a535f83dc79a17",
      "old_mode": 33188,
      "old_path": "test/lish/publishing_to_and_from_archive_test.dart",
      "new_id": "e3d2686fd3095b56bc34b3692732155855a8145a",
      "new_mode": 33188,
      "new_path": "test/lish/publishing_to_and_from_archive_test.dart"
    },
    {
      "type": "modify",
      "old_id": "27df55f2ea661afb7dd661e49964af400a5e150a",
      "old_mode": 33188,
      "old_path": "test/lish/utils.dart",
      "new_id": "7908de7064dccc5ada69c5509420d15aad989685",
      "new_mode": 33188,
      "new_path": "test/lish/utils.dart"
    }
  ]
}