Support offline verification?

[mgorny]

FWICS the verify pypi command can currently only work by downloading artifacts from PyPI. It would really help me implementing downstream verification of artifacts if it would accept prefetched distribution file and provenance JSON.

[woodruffw]

Hi @mgorny, sorry for the delayed response.

Yes, IMO it'd be good to support offline verification on the CLI here. However, it's worth noting that we currently consider the CLI of this package unstable (unlike the API), so you might not want to depend too much on it (assuming you're building distro-specific tooling for consuming package attestations).

From the Python API, you can accomplish offline verification using the APIs documented here: https://github.com/trailofbits/pypi-attestations#signing-and-verification. Do you think your use case is one where you could use these APIs directly? If so I'd recommend that; if not we can look into extending the CLI for your case 🙂

[mgorny]

If the API permits doing roughly the same thing as verify pypi command, then I suppose so, yes. However, it kinda feels redundant implementing an extra tool that does exactly the same thing as this CLI here. We're fine with using experimental API — we have control over the exact version used, so we can just update the calls if it changes.