Is it possible/planned to add the sigstore output to the output files?

[MajorTanya]

Hello everyone,

I checked the packaging user guide today and saw that my personal approach was apparently based on an outdated version of the guide since I still had a separate gh-action-sigstore-python step in my publishing workflow. Now knowing that gh-action-pypi-publish already signs the release with sigstore, I fixed my workflow.

Sadly this means I (apparently?) cannot include the XX.sigstore.json files in my releases anymore since this workflow doesn't seem to produce them under dist/ the way gh-action-sigstore-python did.

My question is this: Am I missing something / is support for including these files in the action output planned? And if not, would I have to use the

   with:
     attestations: false

option on this action and add the gh-action-sigstore-python action back to my workflow?

Best Regards

[webknjaz]

There's a plan to start uploading to GH attestations directly. Though, it requires some work.
I don't think we'll be exposing publish attestations. Though you can probably retrieve them from PyPI if you really need.
Don't disable attentions. You can't upload manually crafted ones.
If you want, you can produce signatures separately. I tend to do so myself, in separate jobs. I use GH-native, Sigstore and SLSA. I think, one example where you can find this is ansible/awx-plugins, another one would be cherrypy/cheroot.
Though, William thinks people should just drop the sigstore step..

[MajorTanya]

Sounds sensible. I was just wondering about those sigstore.json files, but I guess they aren't really necessary to appear in the list of release assets.

Thanks for the quick reply ❤️

[webknjaz]

No problem :) I extended the response a little.