Skip to content

Migrate to/back-fill Sigstore bundles for Python releases #2300

@sethmlarson

Description

@sethmlarson

Sigstore bundles is the new way to distribute verification materials which is better for verifiers because it allows for offline verification. Many older Python releases don't have bundles, but we can create the bundles from the existing verification materials.

I've created a script which creates a bundle from existing materials. We can then publish these new verification materials after independently verifying them against existing artifacts.

After all releases have a bundle associated with them we can update the Sigstore documentation to use bundles for verification instead of disconnected verification materials.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions