Publisher signature or attestation for the exact Windows wheel, opencv-python 4.14.0.94

未關閉
  • 哪裡不對？
#1,277 2 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

評估

難度
3/5
預估耗時
1-2 天
新手友好度
35/100
Issue 類型
文件
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
github-actions, python
領域
release, security

研究方向

Start by reviewing the repository’s release and Windows CI workflow for the specified wheel and run, then check the official PyPI and GitHub attestation sources named in the issue. Determine whether an existing signature or attestation and an independent publisher verification policy cover the exact wheel bytes. Done means providing an official pointer to both, or confirming that no existing proof was found.

由索引模型根據 Issue 內容生成。

描述

Hello opencv-python maintainers,

We are preparing a reproducible offline Python environment and need to locate
publisher-authenticated evidence for this existing, unmodified wheel:

Field Exact value
Package opencv-python 4.14.0.94
Filename opencv_python-4.14.0.94-cp37-abi3-win_amd64.whl
Size 41,166,165 bytes
SHA256 ace53616cdffc9643e17e075397b493e607c427d388c7508798ef7ad2ed577cc
Official repository opencv/opencv-python
Release / tag 4.14.0.94 / 94
Commit 2ba8bf62f2f1215ab620416b041c9659005fa25c
Windows CI run 30346216575, attempt 1
CI artifact wheel-0-0-0-x64, ID 8683370453

We already established byte-for-byte equality between this PyPI wheel and the
wheel inside the official CI artifact. We retain that evidence separately from
publisher signature verification.

Could you point us to an existing signature/attestation bundle and the official
publisher verification policy for this exact wheel? We need the original signed
statement or detached signature, its certificate/public verification material,
and the required transparency or timestamp evidence. The policy should identify
the authorized public key or signer identity, issuer and predicate, as applicable,
through an official source independent of the candidate bundle itself.

Our dated public observations returned HTTP 404 for this wheel's PyPI provenance
endpoint and for the repository's GitHub attestation queries on the wheel and CI
container digests. The legacy Rekor index returned no UUIDs for those two digests.
We recognize that these results are incomplete discovery observations and do
not establish that no signature exists elsewhere.

If there is no existing proof, please let us know. If the project can issue a
new authorized publisher endorsement of the same bytes, we can assess it in a
new review while retaining its actual issue time and scope. We would not present
a later endorsement as proof that the original historical build/publication was
signed when it occurred. We are not asking for a wheel rebuild or replacement.

Only public verification material is needed; please do not provide any private
key, credential, password or access token. A pointer to the appropriate official
policy or existing artifact is sufficient for the next review.

Thank you.

主要語言
Python
星號
5.4k
分支
1.1k
30 天內沒有已合併 PR

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

opencv/opencv-python 的其他 Issue

查看 opencv/opencv-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。