-
Couldn't load subscription status.
- Fork 7
Open
@woodruffw
Description
We should evaluate support for PEP 751!
More specifically: PEP 751 explicitly includes support for attestation identities via [[packages.attestation-identities]].
For example:
lock-version = '1.0' environments = ["sys_platform == 'win32'", "sys_platform == 'linux'"] requires-python = '==3.12' created-by = 'mousebender' [[packages]] name = 'attrs' version = '25.1.0' requires-python = '>=3.8' wheels = [ {name = 'attrs-25.1.0-py3-none-any.whl', upload-time = 2025年01月25日T11:30:10.164985+00:00, url = 'https://files.pythonhosted.org/packages/fc/30/d4986a882011f9df997a55e6becd864812ccfcd821d64aac8570ee39f719/attrs-25.1.0-py3-none-any.whl', size = 63152, hashes = {sha256 = 'c75a69e28a550a7e93789579c22aa26b0f5b83b75dc4e08fe092980051e1090a'}}, ] [[packages.attestation-identities]] environment = 'release-pypi' kind = 'GitHub' repository = 'python-attrs/attrs' workflow = 'pypi-package.yml'
We should be able to consume a PEP 751 lockfile, convert its attestation identities into appropriate policies, and verify against them.
Metadata
Metadata
Assignees
Labels
No labels