Request: independently verifiable source signing and reproducible-build details for v7.0.0
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- git, github, python
- Domain
- build-system, documentation, release, security
Research direction
Start by reviewing the v7.0.0 annotated tag, peeled commit, source archive, wheel, and source distribution named in the issue. Check the project's release and packaging process for maintainer signatures, key bindings, hashes, build-tool and dependency versions, and provenance records. Done means documenting or publishing authoritative answers for the six requested provenance and reproducibility questions.
Written by the indexing model from the issue text.
Description
Hello maintainers,
I am reviewing python-tuf v7.0.0 for use in a security-sensitive, offline-verification workflow.
I could verify the following GitHub objects:
- Annotated tag object:
fed65f73486314242cc738fc7c5c891f5d7fc369 - Peeled commit:
353bdb767db56fd4667c9bcf56b710d50fdc2ac0
GitHub shows the tag as verified through GitHub's web-flow signing key. However, I have not found an independently published maintainer signature or key binding that can authenticate these source objects without initially trusting GitHub as the identity authority.
Could you please clarify:
- Is there an official non-GitHub location that binds the v7.0.0 tag or commit to a maintainer-controlled signing-key fingerprint?
- Is a detached signature or signed release statement available for the tag, commit, or source archive?
- What is the canonical SHA-256 digest of the source archive used to build the published v7.0.0 artifacts?
- What exact build-tool and dependency versions were used for the release?
- Are the wheel and source distribution intended to be byte-for-byte reproducible from the tagged source? If not, which content-level comparison is considered authoritative?
- Are there plans to publish provenance or attestations that bind the source commit to the PyPI artifacts?
This is a supply-chain provenance question, not a vulnerability report. No private repository information or credentials are involved.
Thank you.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 306
- Avg merge
- 4d 40m
- Merged PRs (30d)
- 12
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from theupdateframework/python-tuf
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
theupdateframework/python-tuf#3044 ·
Maintainers usually reply within 1 day
-
Metadata API: SuccinctRoles.is_delegated_role() accepts non-canonical bin namesPossibly taken @Anandb71 claimed this 23 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 42/100
theupdateframework/python-tuf#3033 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
theupdateframework/python-tuf#3001 ·
Maintainers usually reply within 1 day
-
enhancement github_actions
Difficulty 3/5 1-2 days Newbie friendliness 45/100
theupdateframework/python-tuf#2920 · 1 comment · 2 reactions ·
Maintainers usually reply within 1 day
-
Investigate/test fetcher retriesPossibly taken @ishaanxgupta claimed this 308 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
theupdateframework/python-tuf#2842 · 3 comments ·
Maintainers usually reply within 1 day
All issues in theupdateframework/python-tuf
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
django-cms/djangocms-frontend#413 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
NanmiCoder/MediaCrawler#1004 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
facebookresearch/xformers#1417 ·
-
question
Difficulty 1/5 Under an hour Newbie friendliness 68/100
vllm-project/vime#524 ·
Maintainers usually reply within 7 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
FinanceFlash/unvibecode#675 ·
Maintainers usually reply within 1 day