pypi/pypi-attestations

Issues

• tracking issue for rekor 2 adoption in pypi ecosystem

  #147 opened a month ago
  2

• Make me a maintainer

  #146 opened a month ago
  1

• Ensure pypi attestations can handle timestamps (and as result rekorv2 log entries)

  #142 opened a month ago
  1

• upgrade to sigstore-python 4.0

  #141 opened a month ago
  2

• Clarify copyright holder

  #136 opened 3 months ago
  2

• Drop `sigstore_protobuf_specs`

  #131 opened a month ago
  0

• Support downloading verified wheels

  #130 opened 5 months ago
  1

• Don't normalize distribution filenames

  #123 opened 6 months ago
  0

• CI: Address deprecation warnings

  #116 opened 7 months ago
  0

• Support Google Cloud publishers

  #113 opened 7 months ago
  6

• Support for PEP 751

  #112 opened 7 months ago
  1

• `pypi-attestations convert` should also be able to convert attestations to Sigstore bundles

  #111 opened 7 months ago
  0

• Please support offline verification

  #102 opened 8 months ago
  1

• Support offline verification?

  #95 opened 8 months ago
  2

• Outdated example in README

  #90 opened 9 months ago
  0

• Usage with multiple-subject attestations

  #89 opened 9 months ago
  4

• Feature request: support validating more claims with: pypi-attestations verify pypi

  #85 opened 10 months ago
  5

• Feature request: support short package files identifiers as arguments for: pypi-attestations verify pypi

  #84 opened 9 months ago
  0

• API improvements

  #63 opened a year ago
  2

• Difficulties with `pypi_attestations verify`

  #55 opened a year ago
  7

• CLI: add a `convert` subcommand?

  #52 opened 8 months ago
  0

• Consider switching `Publisher` to be a `RootModel`

  #44 opened 8 months ago
  2

• API: Don't do I/O in sign/verify APIs

  #33 opened a year ago
  3

• API: `Attestation.sign` should not leak 3p exceptions

  #23 opened a year ago
  0

• Small CLI driver

  #21 opened a year ago
  2

• Refactor: turn helpers into instance methods

  #14 opened a year ago
  0

• `AttestationPayload.from_dist` should probably do SHA256 in a streaming fashion

  #13 opened a year ago
  0

• Rename to `pypi-attestations`

  #6 opened a year ago
  0

• New APIs: `AttestationPayload` and helpers

  #5 opened 2 years ago
  0

• Pin `sigstore-python` to a released version

  #3 opened 2 years ago
  0

• Switch to Pydantic for models

  #2 opened 2 years ago
  3