Configuration

The plugin registers one structured setting for operational inputs and one flat boolean for opt-in package verification:

plugins:
  conda_sigstore:
    max_sidecar_bytes: 10485760
    trust_config: null
  conda_sigstore_enforce: false

Omitting either setting uses the values shown above. With enforcement false, the package-verifier hook yields no verifier and package operations are unchanged.

Operational settings

Field	Type	Default	Meaning
max_sidecar_bytes	positive integer	10485760	Maximum bundle or sidecar bytes read before parsing
trust_config	local path or null	null	Complete Sigstore client trust configuration used for signing and verification

Unknown fields are rejected. A configured trust_config path is expanded from ~ and must identify an existing regular file. The file is read with a 1 MiB limit before JSON parsing.

Source auditing also enforces fixed archive, YAML, and declaration limits. See Source-audit limits for their values and result statuses.

trust_config file contract

trust_config must contain the complete JSON object accepted by sigstore.models.ClientTrustConfig.from_json() in the supported sigstore-python 4.x series. A TrustedRoot object by itself is not a valid value.

The required top-level shape is:

{
  "mediaType": "application/vnd.dev.sigstore.clienttrustconfig.v0.1+json",
  "trustedRoot": {
    "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
    "tlogs": [],
    "certificateAuthorities": [],
    "ctlogs": [],
    "timestampAuthorities": []
  },
  "signingConfig": {
    "mediaType": "application/vnd.dev.sigstore.signingconfig.v0.1+json",
    "caUrls": [],
    "oidcUrls": [],
    "rekorTlogUrls": [],
    "rekorTlogConfig": null,
    "tsaUrls": [],
    "tsaConfig": null
  }
}

This example shows the fields, not a usable trust configuration. The arrays must contain the keys, certificates, validity intervals, operators, and service endpoints for the Sigstore instance. Binary keys and certificates use the base64 encoding defined by the Sigstore protobuf JSON mapping.

Top-level field	Required value
mediaType	Exactly application/vnd.dev.sigstore.clienttrustconfig.v0.1+json
trustedRoot	A Sigstore TrustedRoot containing transparency-log keys, Fulcio certificate authorities, certificate-transparency log keys, and optional timestamp authorities
signingConfig	A Sigstore SigningConfig containing the Fulcio, OIDC, Rekor, and optional timestamp-authority service configuration

The nested TrustedRoot, SigningConfig, certificate, public-key, service, and validity structures are defined by the Sigstore trust-root protobuf. The parser rejects unknown fields and unsupported media types.

Verification reads trustedRoot. conda sigstore attest also reads signingConfig to obtain OIDC, Fulcio, Rekor, and timestamp service configuration. This is why the setting requires the complete client trust configuration even when an operator only plans to verify locally.

With trust_config: null, the plugin obtains Sigstore’s production client trust configuration. Verification honors conda’s offline setting and uses the local Sigstore TUF cache when offline. A configured file is read directly and is not updated through TUF by this plugin.

Parsing a local file proves only that it has the expected structure. Operators are responsible for authenticated provisioning, freshness, rotation, rollback protection, and incident response for custom trust material.

Install-enforcement setting

Setting	Type	Default	Meaning
plugins.conda_sigstore_enforce	boolean	false	Require valid CEP 27 evidence before package extraction

Conda accepts its standard environment-variable override:

CONDA_PLUGINS_CONDA_SIGSTORE_ENFORCE=true conda install PACKAGE

The hook is registered against the unreleased API in conda/conda#16518. See Upstream integration contracts for its inputs, evidence selection, and rejection behavior.