Skip to content

Conversation

@mgorny
Copy link
Contributor

@mgorny mgorny commented Sep 3, 2025

Companion to gentoo/gentoo#43549. The code's a bit hacky, suggestions welcome.

Current results: pypi-provenance.txt

@mgorny
Copy link
Contributor Author

mgorny commented Oct 13, 2025

@arthurzam, any opinion on this implementation?

Signed-off-by: Michał Górny <mgorny@gentoo.org>
Signed-off-by: Michał Górny <mgorny@gentoo.org>
@mgorny mgorny marked this pull request as ready for review October 25, 2025 17:24
@mgorny
Copy link
Contributor Author

mgorny commented Oct 25, 2025

Okay, I've added a "positive" test. Unfortunately, I haven't been able to figure out how to make a "negative" test work.

@ferringb
Copy link
Contributor

Okay, I've added a "positive" test. Unfortunately, I haven't been able to figure out how to make a "negative" test work.

By negative assertion, are you referring to trying to flex these except handlers? If not- what are the failures you're trying to assert, at least at a high level?

This futures/execution setup is new to me, but being attestations are immutable- what's your thoughts on locally caching the results of past positive checks in such a fashion that network request doesn't need to be made again if it's in the cache?

@mgorny mgorny deleted the pypi-provenance branch November 22, 2025 09:34
@mgorny
Copy link
Contributor Author

mgorny commented Nov 22, 2025

Kinda. A test that the result isn't output when attestation URL gives 404.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants