[Roadmap] Implement PEP 740 #15871
Description
PEP 740 is in a final but not yet approved state. This issue is intended to lay out the dependencies/subcomponents of its implementing, including things that can be done in a preliminary manner.
Index side
- Support the
attestationsform field in the current legacy upload endpoint - Parse each received attestation from
attestationsand verify each against the uploading trusted publisher; fail the file upload if any attestations are invalid- This should be done in as generic a manner as possible, to ensure that future extension to email and key identities is possible.
- Persist verified attestations and expose them via the PEP 503 and Simple JSON API indices (via provenance objects, as specified in PEP 740)
Uploader/publish side
- Support attestation generation in
gh-action-pypi-publish- Concretely, this means
gh-action-pypi-publishshould usesigstore-pythonto sign the attestation payload defined in PEP 740 - The resulting bundle should be transformed into a PEP 740 attestation object
- Concretely, this means
- Support attestation uploading in
twine: Proposal: preliminary support for PEP 740 pypa/twine#1094 - Once
twinesupports uploading,gh-action-pypi-publishshould use that support to actually upload the attestation objects it generates above
Docs & UI
- Update all relevant docs (PyPI's docs, PyPUG)
- Add a per-artifact view #16491
- PEP 740 blog post #17070
CC @di @webknjaz @facutuesca for visibility