Four supply‑chain badges for a one‑person open‑source project, in a day

Description and use

All four badges were obtained in a single day, demonstrating compliance with security best practices, licensing, and build provenance.

Problem

A solo maintainer needed to prove that the project is run properly, licensed cleanly, and that the PyPI package is built from the repository.

Outcome

All four badges were obtained in a single day, demonstrating compliance with security best practices, licensing, and build provenance.

Workflow

• 1. Run bestpractices.dev self‑certification, filling in links to SECURITY.md, CONTRIBUTING.md, and CodeQL results.
• 2. Run OpenSSF Baseline Level 1 checklist, fixing branch protection to require PRs and disable admin bypass.
• 3. Run REUSE lint to annotate files via REUSE.toml, identify missing third‑party headers, and register with api.reuse.software.
• 4. Configure slsa-github-generator to generate provenance after publish, download wheel and sdist, attest hashes, and verify with slsa-verifier.
• 5. Document verification command, correcting the source‑branch flag issue.