Verify locked environments during installation#

Install conda-sigstore, conda-lockfiles, and conda-workspaces in the Python environment that owns the conda command. The source-preview test environment already includes all three.

For a future supported installation, install the companion plugins from conda-forge into the owning conda prefix:

conda install --prefix "$(conda info --base)" --channel conda-forge \
  "conda-lockfiles>=0.2.1" "conda-workspaces>=0.8"

conda install --prefix (conda info --base) --channel conda-forge `
  'conda-lockfiles>=0.2.1' 'conda-workspaces>=0.8'

Confirm that conda discovers their commands:

conda create --help
conda workspace --help

Install from a lockfile#

Enable verification for one conda create invocation.

CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE=true \
  conda create --name example --file pixi.lock --format rattler-lock-v6

CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE=true \
  conda create --name example --file conda-lock.yml --format conda-lock-v1

On PowerShell, set and remove the environment variable around the same command:

$env:CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE = 'true'
conda create --name example --file pixi.lock --format rattler-lock-v6
Remove-Item Env:CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE

Every package archive extracted by the command must have one valid CEP 27 statement that binds its exact filename and SHA-256. Missing or invalid evidence fails the installation.

Install a workspace#

Run the locked install from the workspace root:

CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE=true \
  conda workspace install --locked

$env:CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE = 'true'
conda workspace install --locked
Remove-Item Env:CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE

The workspace command routes conda package extraction through the same verifier hook. The manifest still defines intent and the lockfile still defines the selected package set.

Know what remains outside the hook#

  • Keep lockfile SHA-256 entries. They select exact bytes while Sigstore verifies signed evidence for those bytes.

  • Locked records that do not retain PR 142’s attestations_sha256 field require adjacent <artifact>.v0.sigs evidence under the separate Prefix.dev compatibility policy. Current conda PackageRecord objects do not preserve that field.

  • Pip packages and unchanged prefix contents are not newly verified by this hook. With enforcement enabled, conda does not reuse an extracted-only cache entry. It finds or redownloads the archive and verifies it before extraction, or fails offline.

  • Offline installation also needs prepared package, repodata, sidecar, and trust-material caches. See Verify offline.

Use Audit an environment to inspect an existing prefix.

On this page
Show Source