Skip to content

Conversation

@woodruffw
Copy link
Contributor

@woodruffw woodruffw commented Jan 9, 2024

Adds a PEP for "Index support for digital attestations," which proposes changes to the (unstandardized) upload API and two standard index APIs to expose both digital attestations and additional index-level metadata that will assist consumers in verifying those attestations.

For prior pre-PEP discussion, see: https://discuss.python.org/t/pre-pep-exposing-trusted-publisher-provenance-on-pypi/42337/40


📚 Documentation preview 📚: https://pep-previews--3618.org.readthedocs.build/pep-0740/

Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
@Rosuav
Copy link
Contributor

Rosuav commented Jan 10, 2024

Has this been discussed anywhere? Who is sponsoring this?

@woodruffw
Copy link
Contributor Author

Has this been discussed anywhere?

Yes: https://discuss.python.org/t/pre-pep-exposing-trusted-publisher-provenance-on-pypi/42337/40

Who is sponsoring this?

This is still in draft because I'm currently working with a group of people (including the PyPI administrators) to determine the appropriate sponsor.

@Rosuav
Copy link
Contributor

Rosuav commented Jan 10, 2024

Has this been discussed anywhere?

Yes: https://discuss.python.org/t/pre-pep-exposing-trusted-publisher-provenance-on-pypi/42337/40

Cool, can you include that link in the PEP draft please? It might end up getting replaced at some point with a different link, but at least that'll give a bit of context to the draft. Bear in mind that not all of us read every typing-related thread in detail :)

@woodruffw
Copy link
Contributor Author

woodruffw commented Jan 10, 2024

Cool, can you include that link in the PEP draft please? It might end up getting replaced at some point with a different link, but at least that'll give a bit of context to the draft.

Sure, no problem! I'm on mobile at the moment, but I'll update the draft once I'm in front of a computer. Apologies for any confusion I've caused 🙂

@Rosuav
Copy link
Contributor

Rosuav commented Jan 10, 2024

Sure, no problem! I'm on mobile at the moment, but I'll update the draft once I'm in front of a computer.

Yep, no rush, just trying to make sure everyone can see what's going on. Thanks!

Signed-off-by: William Woodruff <william@yossarian.net>
woodruffw and others added 3 commits January 10, 2024 11:46
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
@woodruffw woodruffw marked this pull request as ready for review January 11, 2024 20:57
@woodruffw woodruffw requested a review from a team as a code owner January 11, 2024 20:57
@dstufft
Copy link
Member

dstufft commented Jan 11, 2024

I'll take a look through in a bit, but just to publicly record it, I'm fine sponsoring this and being the delegate for it (It's PyPI so I'm the default delegate anyways).

@woodruffw
Copy link
Contributor Author

I've marked this as ready for review, now that it has a sponsor and PEP-Delegate (thank you @dstufft!)

woodruffw and others added 2 commits January 12, 2024 09:55
Signed-off-by: William Woodruff <william@yossarian.net>
@ghost
Copy link

ghost commented Jan 12, 2024

All commit authors signed the Contributor License Agreement.
CLA signed

@hugovk hugovk changed the title Draft PEP: Index support for digital attestations PEP 740: Index support for digital attestations Jan 12, 2024
woodruffw and others added 4 commits January 12, 2024 10:09
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Apparently the PEP index can't handle multiple emails for a single
human name.

Signed-off-by: William Woodruff <william@yossarian.net>
@woodruffw
Copy link
Contributor Author

For visibility, I had to revert my email address change because of this:

                                                                              
Extension error (pep_sphinx_extensions.pep_zero_generator.pep_index_generator)
:                                                                             
Handler <function create_pep_zero at 0x107615760> for event 'env-before-read-docs' threw an exception (exception: some authors have more than one email address listed:
    William Woodruff: {'william@trailofbits.com', 'william@yossarian.net'})
Command exited with exit code: 2

@hugovk
Copy link
Member

hugovk commented Jan 12, 2024

Yeah, that's a rather annoying restriction, maybe we should consider removing it? Another option is to also use your ToB email in the other PEPs if you prefer.

@hugovk hugovk added the new-pep A new draft PEP submitted for initial review label Jan 12, 2024
@woodruffw
Copy link
Contributor Author

Yeah, removing it would be ideal (but I can imagine it might be non-trivial, if it's a restriction in the first place).

Using my personal email here is not a significant problem -- the ToB email would accurately reflect that this is for work rather than just funsies, but we have it tracked on our side anyways 🙂

Copy link
Contributor

@sethmlarson sethmlarson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this! Here are some thoughts from me on this PEP:

Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
@woodruffw
Copy link
Contributor Author

All feedback above is addressed/resolved, so I think approval/merge is next here (unless I've missed something) 🙂

Copy link
Member

@hugovk hugovk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also ping sponsor @dstufft.

@dstufft
Copy link
Member

dstufft commented Jan 29, 2024

LGTM, let's get the discussion rolling!

@hugovk hugovk merged commit a85fa91 into python:main Jan 29, 2024
@woodruffw woodruffw deleted the ww/publish-provenance branch January 29, 2024 21:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

new-pep A new draft PEP submitted for initial review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants