Documentation / Guides / Private distribution

Distribute VAANI privately

Until stable publication completes, distribute the exact approved RC9 bytes through an authenticated artifact channel.

Artifact Registry-style flow

The commands vary by registry, but the safe sequence is stable:

1. Create a private Python repository in the deployment's approved region.
2. Authenticate CI with a short-lived workload identity.
3. Verify the local RC9 wheel SHA-256.
4. Upload that exact wheel without rebuilding or renaming it.
5. Grant consumer CI read-only access.
6. Configure the consumer's index URL through CI secrets.
7. Pin vaani==1.0.0rc9 and the wheel hash in the consumer lock.
8. Verify installed version and module provenance in the built image.

Generic upload:

python -m pip install build twine
python -m twine upload \
  --repository-url "https://packages.example.invalid/python/" \
  vendor/vaani-1.0.0rc9-py3-none-any.whl

Use registry-specific keyring or token injection. Do not paste a token into the repository URL in committed files.

Consumer lock example

vaani==1.0.0rc9 \
  --hash=sha256:58b0748becca9f436b8acd0e2dd792a64c60dd75de33d5600003e8ff690c6bd1

Install provider extras through the lock mechanism supported by your package tool, preserving the exact VAANI pin.

Provenance check

At image build time, print:

• importlib.metadata.version("vaani");
• resolved vaani.__file__;
• the lock/artifact digest recorded by the build.

Fail if the version is not 1.0.0rc9 or the module resolves outside the intended environment. Source development and editable installs are not substitutes for artifact verification.

Next: installation choices or production readiness.