sigstore/sigstore-python

sigstore-python is a codesigning tool for Python packages that generates and verifies Sigstore signatures.

The tool addresses the need for secure, keyless code signing in Python supply chains. It implements Sigstore's keyless signature model, eliminating the burden of managing long-lived signing keys. The approach uses OpenID Connect ambient credentials to establish identity during signing, allowing developers to sign artifacts without storing secrets. Signatures can be verified against the signer's identity, and the tool supports both standard signatures and DSSE envelope formats for attestation.

Developers should adopt this tool if they maintain Python packages and want to provide cryptographic proof of origin without key management overhead. It works well for projects already using GitHub Actions, where ambient credentials are readily available, and for any scenario where keyless signing reduces operational complexity. The tool provides both a command-line interface and an importable Python API, making it suitable for integration into CI/CD pipelines or direct use in Python applications. The README does not compare it to alternative signing approaches.

The project maintains active continuous integration workflows covering both standard testing and conformance tests. Documentation is generated and published automatically through CI. The tool achieves SLSA Level 3 provenance, indicating structured build and verification practices. Security posture is tracked through OpenSSF Scorecard assessments.