5 ms·

Is there any effort to integrate SLSA with PyPI? GitHub recently announced[1] that npm support for SLSA is GA now. [1] https://github.blog/changelog/2023-09-26

• SethMLarson 3y ago
  Great question! PyPI already supports Trusted Publishers [1], which gets you most of the benefits of SLSA build provenance (provable link between artifacts and a public software repository). Implementing Trusted Publishers is the recommended first step for ecosystems looking to implement build provenance [2]. [1] https://docs.pypi.org/trusted-publishers/ https://docs.pypi.org/trusted-publishers/ [2] https://github.com/ossf/wg-securing-software-https://docs.pypi.org/trusted-publishers/repos/blob/main/docs/build-provenance-for-all-package-registries.md https://github.com/ossf/wg-securing-software-https://docs.py... I don't think there's a big effort /right now/ to implement complete SLSA build provenance for PyPI and expose it for users to verify.