ENH,SEC: Add conda-content-trust support to not bypass signature verification in conda >= 23.10

[westurner]

• @conda/conda-content-trust: https://github.com/conda/conda-content-trust/issues/123

  • Conda Security Practices > "Enabling conda signature verification" https://docs.anaconda.com/pro/security/#enabling-conda-signature-verification

  • conda install "conda>=4.10.1" "conda-token>=0.3.0" conda-content-trust
    conda token set --enable-signature-verification <YOUR_PRODUCT_TOKEN>

    Conda version 23.10+ uses libmamba as the default solver, which bypasses signature verification. If you are using conda 23.10 or later, you must configure your .condarc file to use the classic environment solver by running the following command: conda config --set solver classic

• conda-content-trust

  • src: https://github.com/conda/conda-content-trust
  • docs: https://docs.anaconda.com/pro/security/
  • TUF package signatures for conda packages
  • verify_signature() https://github.com/conda/conda-content-trust/blob/main/conda_content_trust/authentication.py#L253