Install conda-sigstore

conda-sigstore must be installed in the Python environment that owns the conda executable. A plugin installed in an unrelated environment is not discovered by that conda executable. The environment must use Python 3.11 or newer.

conda 26.5 and newer include the conda-pypi plugin, which can download the published wheel from PyPI, convert it to a conda package, and install it into the environment that owns conda.

For a standard conda installation, activate base and install 0.1.2 from PyPI:

conda activate base
conda pypi install "conda-sigstore==0.1.2"
conda sigstore --help

conda pypi install is pending removal in conda 27.9. If the command is not available, use the pip method below. The conda-pypi channel does not currently serve conda-sigstore.

The help output should list attest, verify, and audit. Start with Verify a public package.

Install with pip

Create a dedicated environment that contains conda, pip, and the plugin:

conda create --name conda-sigstore "python>=3.11" conda pip
conda activate conda-sigstore
python -m pip install "conda-sigstore==0.1.2"
conda sigstore --help

The PyPI distribution does not install conda. If you instead add the plugin to an existing conda installation, run pip with that installation’s Python interpreter.

Warning

The opt-in pre-extraction verifier requires the unreleased package-verifier API in conda/conda#16518. Released conda versions can load the other plugin commands, but they cannot enable that install hook.

Current conda PackageRecord objects also do not preserve PR 142’s attestations_sha256 field. A corresponding conda change is required before real solver and install flows can select the draft content-addressed sidecar. plugins.conda_sigstore_enforce remains false by default.

Preview install enforcement from source

Use the repository’s locked test environment to evaluate the unreleased conda integration without changing your normal conda installation. You need Pixi and Git.

git clone https://github.com/jezdez/conda-sigstore.git
cd conda-sigstore
pixi install --locked --all
pixi shell -e test
conda init --install
conda sigstore --help

conda init --install is a one-time setup for the source environment. It replaces the pip bootstrap entry point inside .pixi/envs/test with conda’s normal command wrappers. It does not initialize your shell profile.

The locked environment builds a pinned revision from jezdez/conda’s feature/package-verifiers branch, the branch behind the draft hook pull request, as a conda package.

Exit the preview shell when finished:

exit

Read Configure verification before enabling install enforcement.