jazzband/pip-tools

Research ways to support verifying the PEP 740 digital attestations early

Open

Aperta il 26 apr 2024

Vedi su GitHub
 (3 commenti) (0 reazioni) (0 assegnatari)Python (7230 star) (605 fork)batch import
PR wantedenhancementfeaturehasheshelp wantedneeds discussionneeds more infopackaging

Descrizione

The upstream is moving forward now — https://github.com/pypi/warehouse/issues/15871 — so should pip-tools. I don't yet know what it'll look like here but we need to watch for the opportunities to integrate a preliminary support for such security-related features.

Guida contributor

Tech stack
python
Dominio
securitytooling
Tipo issue
feature
DifficoltàQuanto dovrebbe essere impegnativa per un nuovo contributor.
4
Tempo stimatoTempo stimato per completare e verificare uno scope piccolo.
1-2 days
Stato attivitàQuanto è probabile che la issue sia ancora attiva e reviewable.
active
ChiarezzaQuanto chiaramente la issue descrive problema, scope e risultato atteso.
needs investigation
Prerequisiti
PythonPEP 740pip tools internals
Adatta ai principiantiQuanto la issue è adatta a contributor alla prima esperienza.
25
Direzione di ricerca
The issue is to research integration of PEP 740 digital attestations into pip tools. Start by reading the upstream warehouse issue #15871 to understand the attestation verification model. Then explore pip tools' dependency resolution and download code, particularly in piptools/sync.py and piptools/resolver.py, to identify where verification could be inserted. Provide a summary of potential integration points and a proposed approach for preliminary support.