-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
PEP 740: tweak JSON simple API prescriptions #3768
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Just leaving a comment here for myself: the PEP currently specifies that the "distribution name" goes into the attestation payload, but doesn't say anything about how that name is normalized. So we probably need some additional language in the PEP to say that sdist names get the PEP 625 treatment. Wheel names are already pre-normalized, although maybe we should also "ultranormalize" them to handle different postrelease spellings, etc. |
Signed-off-by: William Woodruff <[email protected]>
DigestSet in in-toto is too flexible. Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Per discussion with @dstufft: this removes the embedded provenance objects from the simple API and replaces them with digest references, much like the simple index. This has the virtuous effect of reducing the amount of mostly chaff JSON that client API consumers will need to download.
The added Appendix 3 has further details, including a rationale and concrete numbers. These have also been shared in the discussion thread.
This also changes the attestation format: rather than a fixed attestation payload, this now allows in-toto attestation framework-style payloads, wrapped using DSSE's PAE signature payload encoding format. This makes it easier to distinguish the "intent" of different attestations.
📚 Documentation preview 📚: https://pep-previews--3768.org.readthedocs.build/