Publishing

When your package is ready for others, you publish it as a GitHub release carrying a SLSA Level 2 attestation. You publish a package (a VendorQualifier_Unit id such as CommonsBase_GNU) which includes all the modules in your package source tree. Creating signing keys, producing the release, and how consumers verify and import it are documented in the dk0 Reference Implementation.