Build/upload process using package signatures

mamba-org / quetz

The Open-Source Server for Conda Packages

https://quetz.readthedocs.io/en/latest/

BSD 3-Clause "New" or "Revised" License

276 stars 75 forks source link

Open adriendelsalle opened 3 years ago

adriendelsalle commented 3 years ago

Define one or more process(es) to build and upload signed package, options could be:

online signature
- extra step after build
- use conda-content-trust
- some mamba/boa?
offline signature
- upload pkg/sigs separately
  - auth handling (2FA, matching w/ GitHub accounts and feedstocks maintainers, etc.)
- 2-steps CI: build, download artifact for local signing then upload signature
- build + sign locally
- reproducible builds

wolfv commented 2 years ago

Here is some more text from go-releaser whcih apparently integrates with sigstore now: https://github.com/goreleaser/goreleaser/issues/2659