PEP 740 is in a final but not yet approved state. This issue is intended to lay out the dependencies/subcomponents of its implementing, including things that can be done in a preliminary manner.
Index side
Uploader/publish side
Docs & UI
CC @di @webknjaz @facutuesca for visibility
PEP 740 is in a final but not yet approved state. This issue is intended to lay out the dependencies/subcomponents of its implementing, including things that can be done in a preliminary manner.
Index side
attestationsform field in the current legacy upload endpointattestationsand verify each against the uploading trusted publisher; fail the file upload if any attestations are invalidUploader/publish side
gh-action-pypi-publishgh-action-pypi-publishshould usesigstore-pythonto sign the attestation payload defined in PEP 740twine: Proposal: preliminary support for PEP 740 pypa/twine#1094twinesupports uploading,gh-action-pypi-publishshould use that support to actually upload the attestation objects it generates aboveDocs & UI
PEP 740: initial attestation docs #16063CC @di @webknjaz @facutuesca for visibility