Sigstore for Python Packaging: Next Steps for Adoption

on YouTube ↗25m

" summary

Trail of Bits spends nine months building sigstore-python, a CLI and API that signs and verifies Python distributions, uses OpenID Connect for ambient credentials (GitHub Actions, Google Cloud Build), and is already used to sign CPython 3.11 and CI artifacts daily. It delivers sig and cert files to GitHub releases but does not yet integrate with PyPI or pip: PyPI must accept .sig/.cert or Sigstore bundles and pip must move from PEP 503 to the newer index and support PEP 458/TUF-backed verification for end-to-end trust.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 10:18python package security: integrity
3. 11:49python package security: authenticity
4. 13:53what does sigstore do for python packaging?

" related talks

• 35mAn introduction to Sigstore for PythonistasMaya Costantini · DevConf.CZ 2023
• 29mErgonomic codesigning for the Python ecosystem with SigstoreWilliam Woodruff · PyCon US 2023
• 01h 21mSecure Python Packaging & Release Using Continuous DeploymentJussi Kukkonen, Martin Vrachev · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 31mPEP 740 and PyPI: Bootstrapping Provenance for the Python EcosystemWilliam Woodruff · SOSS Fusion 2024
• 35mSecuring Python projects Supply ChainMaya Costantini, Fridolín Pokorný · DevConf.CZ 2023
• 25m"Security considerations in Python Packaging"Gajendra Deshpande · PyCascades 2022
• 24mShipping your first Python package and automating future publishingChris Wilcox · PyCon AU 2019
• 34mSecure Python Development: Tips, Tricks, and ToolsDominic Delabruere · DevConf.CZ 2023