Hacker News Reader

Is there any effort to integrate SLSA with PyPI? GitHub recently announced[1] that npm support for SLSA is GA now.

[1] https://github.blog/changelog/2023-09-26-npm-provenance-gene...

Great question! PyPI already supports Trusted Publishers [1], which gets you most of the benefits of SLSA build provenance (provable link between artifacts and a public software repository). Implementing Trusted Publishers is the recommended first step for ecosystems looking to implement build provenance [2].

[1] https://docs.pypi.org/trusted-publishers/

[2] https://github.com/ossf/wg-securing-software-https://docs.py...

I don't think there's a big effort /right now/ to implement complete SLSA build provenance for PyPI and expose it for users to verify.

Reply on news.ycombinator.com