PEP 458 a solution not only for PyPI - Kairo de Araujo, Martin Vrachev

[EuroPython 2023 - South Hall 2A on 2023-07-20]
ep2023.europython.eu/session/...
[PEP 458](peps.python.org/pep-0458/) uses cryptographic signing on [PyPI](pypi.org) to protect Python packages against attackers. The implementation of the PEP inspired the [Repository Service for TUF (RSTUF)](repository-service-tuf.readthe..., a project [accepted into the OpenSSF sandbox](github.com/ossf/tac/pull/137). We identified that the design could benefit other organizations and repositories looking to secure their software supply chains.
In this talk we would answer the following questions:
- How did the PEP 458 design help to start the Repository Service for TUF (RSTUF)?
- How could RSTUF be used for PyPI with its millions of packages?
- How can RSTUF be deployed by any organization at any scale without requiring TUF expertise?
Additionally, in this talk, we would give an overview of PEP 458, how it works, and give a high-level overview of TUF.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License creativecommons.org/licenses/b...