Research ways to support verifying the PEP 740 digital attestations early

jazzband / pip-tools

A set of tools to keep your pinned Python dependencies fresh.

https://pip-tools.rtfd.io

BSD 3-Clause "New" or "Revised" License

7.6k stars 607 forks source link

Research ways to support verifying the PEP 740 digital attestations early #2080

Open webknjaz opened 2 months ago

webknjaz commented 2 months ago

The upstream is moving forward now — https://github.com/pypi/warehouse/issues/15871 — so should pip-tools. I don't yet know what it'll look like here but we need to watch for the opportunities to integrate a preliminary support for such security-related features.