conda-sigstore#
conda-sigstore creates and verifies Sigstore attestations for conda packages.
Use it to verify a downloaded package, sign a package for publication, audit an
installed environment, or require valid evidence before conda extracts a
package.
Warning
This is alpha software, distributed through PyPI. Install
verification requires the unreleased conda API in
conda/conda#16518. The draft
repodata and source-attestation formats may change incompatibly. Current conda
PackageRecord objects do not yet preserve the draft repodata
attestations_sha256 field.
Follow the installation guide, then verify a public package. Source contributors can run the same commands from the repository environment.
Choose a documentation path#
Verify a real public package and inspect its signer evidence.
Install the plugin, audit environments, configure inputs, and work offline.
Look up commands, configuration, standards, and upstream contracts.
Understand the design and security properties.
What a verified result means#
A verified result binds the package filename and SHA-256 to a valid Sigstore bundle and reports the authenticated certificate identity and issuer. It does not establish that the signer was authorized to publish to a channel or that the package is safe. Read the security model for the complete set of verified properties and exclusions.