On Tue, 2025-09-02 at 11:07 +0200, Michał Górny wrote: > Introduce a new API to verify provenance of PyPI artifacts. To enable > it, set PYPI_VERIFY_REPO to the upstream repository URL. The eclass > will automatically add a verify-provenance flag along with dependencies, > fetch the provenance file from PyPI and export src_unpack() to verify > it. > > Support for provenance verification can be checked on PyPI's project > page. If it is supported, the project metadata (i.e. "Project links") > is found in "Verified details", whereas otherwise only "Maintainers" > are in that section. It can also be seen under "view details" for > individual artifacts. > > The eclass also provides the low-level functions to account for special > needs: pypi_provenance_url and pypi_verify_provenance. > > The bits are implemented directly in pypi.eclass rather than > verify-sig.eclass since they are pretty tightly bound to PyPI > infrastructure, with nontrivial URLs and a dedicated provenance file > format. On top of that, due to a difference in semantics, the flag > is named verify-provenance rather than verify-sig. > > Signed-off-by: Michał Górny <[email protected]> > --- > eclass/pypi.eclass | 119 +++++++++++++++++++++++++++++++++-- > profiles/arch/amd64/use.mask | 4 ++ > profiles/arch/base/use.mask | 4 ++ > 3 files changed, 122 insertions(+), 5 deletions(-) >
Uh, forgot to add use.desc. To avoid resending the whole series, here's the missing bit: diff --git a/profiles/use.desc b/profiles/use.desc index e82c6e4e046c..dcf4bcd07544 100644 --- a/profiles/use.desc +++ b/profiles/use.desc @@ -363,6 +363,7 @@ valgrind - Enable annotations for accuracy. May slow down runtime slightly. Safe vanilla - Do not add extra patches which change default behaviour; DO NOT USE THIS ON A GLOBAL SCALE as the severity of the meaning changes drastically vcd - Video CD support vdpau - Enable the Video Decode and Presentation API for Unix acceleration interface +verify-provenance - Verify provenance of PyPI distfiles (verifies that the artifact comes from upstream source repository) verify-sig - Verify upstream signatures on distfiles vhosts - Add support for installing web-based applications into a virtual-hosting environment videos - Install optional video files (used in some games) -- Best regards, Michał Górny
signature.asc
Description: This is a digitally signed message part
