Skip to content

Conversation

@facutuesca
Copy link
Collaborator

@facutuesca facutuesca commented Feb 27, 2025

Add support for passing local artifacts and provenance to the verify pypi subcommand:

pypi-attestations verify pypi --repository https://github.com/sigstore/sigstore-python --provenance-file test/assets/sigstore-3.6.1.tar.gz.provenance test/assets/sigstore-3.6.1.tar.gz

Fixes #95

cc @woodruffw @mgorny

Signed-off-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>
@facutuesca facutuesca requested a review from woodruffw February 27, 2025 17:20
@facutuesca facutuesca marked this pull request as ready for review February 27, 2025 17:21
@mgorny
Copy link
Contributor

mgorny commented Feb 27, 2025

Thanks! This seems to work for me.

@woodruffw
Copy link
Member

LGTM, nice work @facutuesca!

@woodruffw woodruffw merged commit 1d1e238 into main Mar 4, 2025
7 checks passed
@facutuesca facutuesca deleted the ft/local-pypi-verify branch March 12, 2025 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support offline verification?

4 participants