python-poetry / python-poetry/poetry
Integrate SLSA into poetry
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 34.3k
- Forks
- 2.5k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 30
Description
Issue Kind
Brand new capability
Description
It would seem that SLSA is a framework to make it safer to work with open source packages.
Now it would also seem to have an integration with releases on github:
https://sethmlarson.dev/python-and-slsa
However, the release procedure of poetry is quite nice and it would be nice to integrate this into the publish procedure. So based on this discussion I open an issue on it.
Impact
It would make it more direct to secure packages that are published with poetry through the slsa framework. This would make it easier to verify that the package stems indeed from the place that was intended.
Workarounds
Right now, it would seem that the main path is to publish directly via github and then you can directly use the github action.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the linked SLSA material, the referenced GitHub discussion, and Poetry's release and publish procedures; no file or test is named in the issue. Define the intended GitHub-based provenance integration and verify that packages published through Poetry can be checked as originating from the intended source.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, python
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100