pypi / warehouse

The Python Package Index

https://pypi.org

Apache License 2.0

3.6k stars 967 forks source link

Improve file-details with certificate claims #17145

Open DarkaMaul opened 4 days ago

DarkaMaul commented 4 days ago

Expose Certificate Claims in UI

This PR implements the UI display of Sigstore certificate claims, providing a more comprehensive view of package attestations.

Capture d’écran 2024-11-21 à 11 05 48

Implementation Details

Displays certificate claims extracted from Sigstore certificates using pypi-attestation
pypi-attestation returns a dict[str, str] mapping OIDs (dotted strings) to their decoded values
Only active OIDs from the Fulcio Claims list are included (OIDs .8 to .22)

Dependencies

Requires https://github.com/trailofbits/pypi-attestations/pull/70
Currently using a temporary container update for pypi-attestation (to be removed before merge)

Closes https://github.com/pypi/warehouse/issues/17122 /cc @di @woodruffw @facutuesca