gcp-attest

Produce Digital Attestations and use PyPI Trusted Publishing using Google Cloud service accounts.

Why

PyPI encourages Trusted Publishing, but their supported platforms do not include Codeberg. This is understandable: Supporting a new platform means trusting it, and for a long time neither of Codeberg's CI options even had an option to issue OIDC tokens.

PyPI trusts Google's OIDC, though. All OIDC tokens issued by Google Cloud IAM can be exchanged against valid PyPI publishing tokens. The same applies to Sigstore and digital attestations.

Google Cloud OIDC tokens usually represent a service account. There are multiple ways to "log in" as said account to issue tokens:

Inside a Google Cloud workflow. This is the expected way and already supported by di/id and pypi-attestations.
Using a long-lived credentials key file.
Using Workload Identity Federation

The last one is interesting, as it allows us to exchange OIDC tokens from any valid identity provider for Google Cloud tokens. This way, Google Cloud acts like a proxy between PyPI and not (yet) supported OIDC providers.

This project aims to simplify publishing process by offering APIs to create attestations and exchange tokens.

Licence

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

gcp_attest-0.3.1.tar.gz (155.2 kB view details)

Uploaded Jul 14, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

gcp_attest-0.3.1-py3-none-any.whl (7.8 kB view details)

Uploaded Jul 14, 2026 Python 3

File details

Details for the file gcp_attest-0.3.1.tar.gz.

File metadata

Download URL: gcp_attest-0.3.1.tar.gz
Upload date: Jul 14, 2026
Size: 155.2 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.2.0 CPython/3.14.6

File hashes

Hashes for gcp_attest-0.3.1.tar.gz
Algorithm	Hash digest
SHA256	`5afa62a2575d5282612c7019108d450abf6a38d9bc82e110323a2528e6dedc17`
MD5	`8ea4c074a9f639999bee7dd2803ba5cc`
BLAKE2b-256	`27fd00f75a1d78450e941b79541a13e95090740004bd69ba3ea370c472dd117a`

See more details on using hashes here.

Provenance

The following attestation bundles were made for gcp_attest-0.3.1.tar.gz:

Publisher: pypi-publish@kytta-dev.iam.gserviceaccount.com

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: gcp_attest-0.3.1.tar.gz
- Subject digest: 5afa62a2575d5282612c7019108d450abf6a38d9bc82e110323a2528e6dedc17
- Sigstore transparency entry: 2168757502
- Sigstore integration time: Jul 14, 2026
Publication detail:
- Token Issuer: https://accounts.google.com
- Service Account: pypi-publish@kytta-dev.iam.gserviceaccount.com