4 ms·

PyPI has only implemented the "server signs whatever's uploaded with that account" part of TUF; there are no Publisher Signatures for packages uploaded to pypi

PyPI has only implemented the "server signs whatever's uploaded with that account" part of TUF; there are no Publisher Signatures for packages uploaded to pypi (because GPG ASC support was removed from PyPI, the ad-hoc signature support was removed from wheel, and only server signatures are yet implemented). https://SLSA.dev/ https://SLSA.dev/ recommends TUF and Sigstore.dev and trusted containers for build-signing. Someday, Twine should prompt a PyPI package uploader to sign the package before uploading it, and download it to (prime the CDN cache and) check the Publisher and Package repo signature(s) at least once.

woodruffw 3y ago
PyPI doesn’t currently implement any part of TUF in a public facing manner, so I’m not sure where you got that from :-). There’s some limited deployment experiments with rstuf, but these are not part of any current server-side package signing scheme. PEP 740 does the rest of what you’ve described, however. And twine already has initial support for it, although it isn’t part of a release yet.
- westurner 3y ago
  "Roadmap for PEP 458" https://github.com/pypi/warehouse/issues/10672 https://github.com/pypi/warehouse/issues/10672