A previous release had provenance metadata, but this release does not. View details.
umarise-core-sdk
Anchor any file to Bitcoin with one API call. Hash-in, proof-out.
artifact → artifact.proof
Zero dependencies. Python 3.8+.
Install
pip install umarise-core-sdk
Anchor a file
from umarise import UmariseCore, hash_buffer
import os
core = UmariseCore(api_key=os.environ["UMARISE_API_KEY"])
with open("release.tar.gz", "rb") as f:
file_hash = hash_buffer(f.read())
origin = core.attest(file_hash)
print(origin.origin_id) # done
Verify a file (no API key needed)
from umarise import UmariseCore, hash_buffer
core = UmariseCore()
with open("release.tar.gz", "rb") as f:
file_hash = hash_buffer(f.read())
result = core.verify(file_hash)
if result:
print(f"Existed since {result.captured_at}")
Verification is public. No account, no API key, no vendor dependency.
CLI
npx @umarise/cli anchor release.tar.gz
# → release.tar.gz.proof
Verify offline:
npx @umarise/cli verify release.tar.gz.proof
# Hash Match ✓ | Bitcoin Block #881234 | 2026-03-05 | VALID
API
| Method | Auth | Description |
|---|---|---|
health() |
Public | API health check |
resolve(origin_id=...) |
Public | Lookup by origin ID |
resolve(hash=...) |
Public | Lookup by hash |
verify(hash) |
Public | Check if hash is anchored |
proof(origin_id) |
Public | Download .ots proof |
attest(hash) |
API Key | Create anchor |
hash_buffer(bytes) |
— | SHA-256 hash, no network |
CI/CD
Use the GitHub Action for automated anchoring:
- uses: AnchoringTrust/anchor-action@v1
with:
file: build.tar.gz
env:
UMARISE_API_KEY: ${{ secrets.UMARISE_API_KEY }}
Every build gets a .proof file. Verifiable offline, independent of Umarise.
Links
License
Unlicense (Public Domain)
1 maintainer
Metadata
1 maintainer
Release files for umarise-core-sdk 1.1.7
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Loss of provenance
These files do not have provenance metadata, despite files in a prior release including this data.
We recommend further investigation before installing these files. View details.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| umarise_core_sdk-1.1.7.tar.gz | 4.6 kB | Without provenance | Details for umarise_core_sdk-1.1.7.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| umarise_core_sdk-1.1.7-py3-none-any.whl | Python 3 | none | any | Details for umarise_core_sdk-1.1.7-py3-none-any.whl |
Total release size: 9.3 kB
Release files / umarise_core_sdk-1.1.7.tar.gz
Loss of provenance
This file belongs to a release without provenance metadata, despite a prior release including this data.
We recommend further investigation before installing this file. View details.
| Download URL | umarise_core_sdk-1.1.7.tar.gz |
|---|---|
| Size | 4.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b650f681ac93240bc8f31bd4420518bf22ced06968c3297e908ea9dbbf792ee0
|
|
BLAKE2b-256 checksum How to use checksums |
2a899392044abc050926c558757bc35cec979c5db3e25476abc7280edbc76941
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.8
|
Release files / umarise_core_sdk-1.1.7-py3-none-any.whl
Loss of provenance
This file belongs to a release without provenance metadata, despite a prior release including this data.
We recommend further investigation before installing this file. View details.
| Download URL | umarise_core_sdk-1.1.7-py3-none-any.whl |
|---|---|
| Size | 4.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
6840f6b5794d79cb8d21fd5dfedc950bbcf66f0e810325777da6ed566078908d
|
|
BLAKE2b-256 checksum How to use checksums |
21380c52a4957f0cd5fe38bfbda557c05bf7d4faa2c3fbb9b1db94330627a282
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.8
|
Security for umarise-core-sdk 1.1.7
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Loss of provenance
A previous release of these files had provenance metadata, but this release does not.
While this could reflect a routine change by the project maintainers, it may also indicate that the release files have been compromised.
Release comparison
- Removed 1.1.4 2 files With provenance
- Added 1.1.7 2 files Without provenance
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
