You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sigstore bundles is the new way to distribute verification materials which is better for verifiers because it allows for offline verification. Many older Python releases don't have bundles, but we can create the bundles from the existing verification materials.
I've created a script which creates a bundle from existing materials. We can then publish these new verification materials after independently verifying them against existing artifacts.
After all releases have a bundle associated with them we can update the Sigstore documentation to use bundles for verification instead of disconnected verification materials.