Navigation
Search
|
PyPI now supports digital attestations
Thursday November 14, 2024. 10:22 PM , from LWN.net
The Python Package Index (PyPI) has announced
that it has finalized support for PEP 740 ('Index support for digital attestations'). Trail of Bits, which performed much of the development work for the implementation, has an in-depth blog post about the work and its adoption, as well as what is left undone: One thing is notably missing from all of this work: downstream verification. This isn't an acceptable end state (cryptographic attestations have defensive properties only insofar as they're actually verified), so we're looking into ways to bring verification to individual installing clients. In particular, we're currently working on a plugin architecture for pip that will enable users to load verification logic directly into their pip install flows.
https://lwn.net/Articles/998215/
Related News |
25 sources
Current Date
Dec, Sun 22 - 18:16 CET
|