conda-sigstore

conda-sigstore creates and verifies Sigstore attestations for conda packages. It can also audit installed environments and, when explicitly enabled, reject a package before extraction when acceptable evidence is unavailable or invalid.

The project is alpha software and is distributed through PyPI. The opt-in install integration requires the unreleased package-verifier API in conda/conda#16518, and draft transport and source-evidence formats may still change incompatibly.

What it does

• Verify a package against a local or remote Sigstore bundle.
• Create a signed CEP 27 publication statement.
• Audit installed packages for publication, provenance, and recipe source evidence.
• Require valid CEP 27 evidence before conda extracts a package.
• Read the draft repodata-advertised immutable .sigs.<sha256> transport and, separately, Prefix.dev's current .v0.sigs convention.

The draft transport follows conda/ceps#142 at commit 241d1cf43f4db5af484be59ad0b840a1b9e5d616. Current conda PackageRecord objects do not preserve its attestations_sha256 field, so real solver, install, and installed-environment audit flows require a corresponding conda change before they can select the draft transport.

Install

conda-sigstore requires Python 3.11 or newer. Install it in the Python environment that owns the conda executable.

conda 26.5 and newer include the conda-pypi plugin. For a standard conda installation, activate base and install 0.1.2 from PyPI as a conda package:

conda activate base
conda pypi install "conda-sigstore==0.1.2"

If conda pypi is not available, follow the installation guide to install the wheel with pip. The guide also documents the source preview and the separate requirements for install enforcement.

Commands

conda sigstore attest PACKAGE --target-channel URL [--output PATH]
conda sigstore verify ARTIFACT --bundle PATH_OR_URL [--channel URL] \
  [--cert-identity IDENTITY --cert-oidc-issuer URL] [--json]
conda sigstore audit [-n ENV | -p PREFIX] [--sources] [--prefix-sidecars] [--json]

Choose the path that matches your task:

• Verify a public package
• Sign a package
• Audit an installed environment
• Configure install verification
• Publish attestations to Prefix.dev
• Look up commands and output formats

Security boundary

A successful result proves that Sigstore verified the bundle and that its CEP 27 statement binds the package filename and SHA-256. It reports the authenticated signer and can compare an included target-channel claim.

It does not prove that the signer was authorized to publish to that channel, that the package was built safely, or that its contents are benign.

Read the security model and report vulnerabilities according to the security policy.

Development

pixi run --locked -e dev check
pixi run --locked -e test test
pixi run --locked -e test bench
pixi run --locked -e docs docs

See the contribution guide for the full development and release workflow. conda-sigstore is licensed under the BSD 3-Clause License.