Prepare development for 1.0.4 release

Bumping the version ensures that subsequent snapshot deployments are bumped to 1.0.4-SNAPSHOT

CHANGELOG.md

@@ -1,9 +1,13 @@
 Change Log
 ==========
 
-Upcoming Version 1.0.3
+Version 1.0.4
 ------------------------------------
-- Kotlin 1.7.0
+- Fixed Maven publishing error in 1.0.3 release
+
+Version 1.0.3
+------------------------------------
+- Kotlin 1.7.10
 - Internal changes to support multiplatform in the future (consumers using Maven instead of Gradle may need to suffix -jvm to the artifact name)
 - Snapshot builds are available prior to final release
 

README.md

@@ -1,7 +1,6 @@
 # kotlin-bip39
 [![license](https://img.shields.io/github/license/zcash/kotlin-bip39.svg?maxAge=2592000&style=plastic)](https://github.com/zcash/kotlin-bip39/blob/master/LICENSE)
-[![@gmale](https://img.shields.io/badge/contact-android@z.cash-5AA9E7.svg?style=plastic)](https://github.com/gmale)
-![Bintray](https://img.shields.io/maven-central/v/cash.z.ecc.android/kotlin-bip39?color=success&style=plastic)
+![maven](https://img.shields.io/maven-central/v/cash.z.ecc.android/kotlin-bip39?color=success&style=plastic)
 
 
 ## Introduction
@@ -26,7 +25,7 @@ Plus, it uses a permissive MIT license and no dependencies beyond Kotlin's stdli
 ## Getting Started
 ### Gradle
 
-Add dependencies (see bintray badge, above, for latest version number such as `1.0.1`):
+Add dependencies (see Maven badge above for latest version number):
 
 ```groovy
 dependencies {

docs/Build integrity.md

@@ -0,0 +1,17 @@
+# Build Integrity
+Multiple tools can be put in place to enhance build integrity and reduce the risk of supply chain issues. These tools include:
+ * Policy — We minimize third party dependencies, especially when they are not provided by Google and JetBrains. We also try to minimize the number of Gradle plugins.
+ * Checklists — Our [pull request checklist](../.github/pull_request_template.md) specifies only running code from contributors after reviewing the changes first. Our [dependency update checklist](../.github/ISSUE_TEMPLATE/dependency.md) specifies verifying lock file changes during dependency updates.
+ * Fixed dependency versions — For our dependency declarations, we use exact dependency versions in gradle.properties instead of version ranges.
+ * GitHub Actions versions use SHA instead of tags
+ * Dependency locking
+     * Gradle buildscript (e.g. plugins) dependencies are locked
+ * Dependency hash or signature verification
+     * Gradle — The SHA256 for Gradle is stored in [gradle/wrapper/gradle-wrapper.properties](../gradle/wrapper/gradle-wrapper.properties) which is verified when Gradle is downloaded for the first time
+     * Gradle Wrapper — The SHA256 for the Gradle Wrapper is verified on the continuous integration server
+     * Dependencies — Verification is NOT currently enabled for buildscript or compile dependencies
+
+# Dependency locking
+## Buildscript
+To update build script dependency locks:
+`./gradlew dependencies --write-locks`

docs/PUBLISHING.md

@@ -67,12 +67,12 @@ See [ci.md](ci.md), which describes the continuous integration workflow for depl
 
 ## Every time
 1. Update the [build number](https://github.com/zcash/kotlin-bip39/blob/main/gradle.properties) and the [CHANGELOG](https://github.com/zcash/kotlin-bip39/blob/main/CHANGELOG.md).  For release builds, suffix the Gradle invocations below with `-PIS_SNAPSHOT=false`.
-3. Build locally
+2. Build locally
     * This will install the files in your local maven repo at `~/.m2/repository/cash/z/ecc/android/`
 ```zsh
 ./gradlew publishKotlinMultiplatformPublicationToMavenLocalRepository --no-parallel
 ```
-4. Publish via the following command:
+3. Publish via the following command:
     1. Snapshot: `./gradlew publishKotlinMultiplatformPublicationToMavenCentralRepository -PIS_SNAPSHOT=true`
     2. Release
         1. `./gradlew publishKotlinMultiplatformPublicationToMavenCentralRepository -PIS_SNAPSHOT=false`

gradle.properties

@@ -28,4 +28,4 @@ ZCASH_ASCII_GPG_KEY=
 # Configures whether release is an unstable snapshot, therefore published to the ZCASH_MAVEN_PUBLISH_SNAPSHOT_URL
 IS_SNAPSHOT=true
 
-LIBRARY_VERSION=1.0.3
+LIBRARY_VERSION=1.0.4