Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Move PyPI releases to Trusted Publishing with attestations; add SBOM generation

未关闭
  • 哪里不对？
#1,342 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
30/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
github-actions, python
领域
devops, security

调研方向

Start by reviewing the release workflows in qBraid and the referenced pyqasm, qbraid-qir, and qbraid-algorithms repositories; the issue’s status table and remaining-items list describe the current gaps. Check the workflow runs and PyPI provenance for the next qbraid release, then scope SBOM generation and release-environment protections across all four repositories. Done means the remaining listed items are implemented and verified.

由索引模型根据 Issue 内容生成。

描述

Status update (2026-09-15): Trusted Publishing is now live on all four repos. SBOM is the only item with no progress anywhere.

Trusted Publishing Attestations Gated env + reviewers SBOM Scorecard
qBraid ✅ (#1346) ◐ unverified ❌ ❌ ✅ 8.0
pyqasm ✅ ✅ ◐ ❌ ✅ 6.9
qbraid-qir ✅ ✅ ❌ ❌ ✅ 6.8
qbraid-algorithms ✅ ✅ ◐ ❌ ✅ 6.3
  • Attestations — confirmed emitted, not just assumed. pyqasm 1.2.0, qbraid-qir 0.6.1 and qbraid-algorithms 0.1.3 (all released 2026-08-27, after their switch) return PEP 740 provenance from https://pypi.org/integrity/<pkg>/<version>/<file>/provenance. qbraid 404s there only because 0.12.2 predates the switch — uploaded 2026-07-11, #1346 merged 2026-08-24 — so the next release should carry it. Still worth setting attestations: true explicitly rather than relying on the action's default.
  • Gated environment — the half that matters is still missing. pyqasm (both release workflows) and qbraid-algorithms (publish.yml only) now declare environment: release; qBraid and qbraid-qir declare none. But every release environment has empty protection rules — no required reviewers, no wait timer — so the key currently scopes the environment without gating anything. Publishing is still guarded by the if: github.actor == ... check alone.
  • SBOM — no movement. No CycloneDX or SPDX step in any workflow in any of the four repos.
  • Scorecard — the closing line below is now outdated. All four publish results (qBraid added the workflow in #1343); scores in the table are from 2026-09-14/15.
  • Hardening drift across repos. #1392 and #1393 put qBraid at Token-Permissions 10 and Pinned-Dependencies 3; the other three sit at 0 and 0. Outside this issue's original scope, but the same rollout.

Remaining: SBOM everywhere; required reviewers on the release environments; environment: keys for qBraid and qbraid-qir; explicit attestations: true; and confirming qbraid provenance on its next release.

---## Problem

All four OSE packages publish to PyPI using a long-lived API token stored as a repository secret. None uses OIDC Trusted Publishing, and none attaches build attestations.

Repo Trusted Publishing (id-token) Build attestations Artifact signing SBOM
qBraid ❌ ❌ ❌ ❌
pyqasm ❌ ❌ ❌ ❌
qbraid-qir ❌ ❌ ❌ ❌
qbraid-algorithms ❌ ❌ ❌ ❌

A standing token is the weakest link in the release path. If one leaks, an attacker publishes a release under our name, and nothing downstream can distinguish it from a genuine one. Combined package downloads are roughly 985,000 lifetime across the four, so the blast radius is not theoretical.

There is also currently no way to trace a published wheel back to the commit that produced it beyond trusting the workflow.

Suggested fix

1. OIDC Trusted Publishing. Configure each package as a trusted publisher on PyPI, then in the release workflow:

permissions:
  id-token: write
steps:
  - uses: pypa/gh-action-pypi-publish@release/v1   # no password: needed

Then delete the PYPI_API_TOKEN secret. Short-lived, workflow-scoped credentials replace the standing token.

2. Build attestations. pypa/gh-action-pypi-publish emits PEP 740 attestations when publishing via Trusted Publishing, which links each artifact to its workflow run and commit.

3. Publishing environment. Put releases behind a GitHub Environment with required reviewers, so publishing is a deliberate step.

4. SBOM. Generate a CycloneDX or SPDX bill of materials per release. Worth doing per installable extra combination as well, given 22 extras reach 37 third-party packages.

Why it matters beyond hygiene

This is a prerequisite for a meaningful OpenSSF Scorecard, which none of the four repositories currently publishes, and it is the concrete form of the "chain of custody" the PESOSE solicitation names.

主要语言
Python
星标
117
派生
66
平均合并
1 天 4 小时
30 天内合并 PR
38

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

qBraid/qBraid 的其他 Issue

查看 qBraid/qBraid 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。