Python 3.12.0 from a supply chain security perspective

• slsa-verifier

  2 204 8.4 Go

  Verify provenance from SLSA compliant builders

  

My biggest takeaway from this article is the Supply chain Levels for Software Artifacts (SLSA) security framework: https://github.com/slsa-framework/slsa-verifier

• setuptools

  21 2,307 9.9 Python

  Official project repository for the Setuptools build system

  

There was/is some discussion in setuptools about how to normalize the tarball (https://github.com/pypa/setuptools/issues/2133#issuecomment-...) coudl something similar be applied to Building Python itself ?

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• wg-securing-software-https

  1 - -

Great question! PyPI already supports Trusted Publishers [1], which gets you most of the benefits of SLSA build provenance (provable link between artifacts and a public software repository). Implementing Trusted Publishers is the recommended first step for ecosystems looking to implement build provenance [2].

[1] https://docs.pypi.org/trusted-publishers/

[2] https://github.com/ossf/wg-securing-software-https://docs.py...

I don't think there's a big effort /right now/ to implement complete SLSA build provenance for PyPI and expose it for users to verify.

• guac

  4 1,176 9.8 Go

  GUAC aggregates software security metadata into a high fidelity graph database.

  

> biggest takeaway from this article is the Supply chain Levels for Software Artifacts (SLSA) security framework

See also GUAC from Kusari, Google, Citi, and others:

“GUAC (Graph for Understanding Artifact Composition) aims to fill in the gaps by ingesting software metadata, like SBOMs, and mapping out relationships between software. When you know how one piece of software affects another, you’ll be able to fully understand your software security position and act as needed.”

https://guac.sh

https://www.kusari.dev

• encapsule

  1 0 6.3 Python

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project