epubveri 0.12.4 — https://github.com/veripublica/epubveri/releases/latest
Mostly a false-positive release: eight wrong findings on valid books.
The one that mattered is Doitsu's, from the obfuscation test book. An obfuscated resource's bytes are ciphertext — and although we printed RSC-004: its content will not be checked, we then went and checked it. Fifteen findings epubcheck doesn't make, ten of them fatal, and the fatals were the worse half: a fatal drops the rest of that document's findings, so they were also hiding whatever was really in those files. Thank you for sending both tools' output beside the book — that turned an afternoon into ten minutes.
The other seven I found by running epubcheck over its own test fixtures and diffing the two outputs. That asks a different question from the one our harness asks, and it sees a class the harness structurally cannot.
New, and relevant if you install or distribute the plugin: every release archive now ships a SHA256SUMS.txt and a signed build attestation.
Code:
shasum -a 256 -c SHA256SUMS.txt --ignore-missing
gh attestation verify epubveri-<target>.tar.gz --repo veripublica/epubveri
The second is the one that carries weight: signed by GitHub for this repository, naming the commit and workflow that produced the file. It comes straight out of KevinH's point in the plugin thread — plugins are short, pure Python, so read the source. Fair, and it doesn't reach a wrapper around a compiled binary. So this is my half of it.
One correction while I'm here: our published corpus recall now reads 599 of 599 instead of 607 of 607. Eight EDUPUB fixtures can't pose their question the way our harness packages them — epubcheck reports nothing there either — and they'd been counted as passes. A smaller denominator, not a better score; the README says why.