Notice: While JavaScript is not essential for this website, your interaction with the content will be limited. Please turn JavaScript on for the full experience.

Sigstore Information

Background

Starting with the Python 3.7.14, Python 3.8.14, Python 3.9.14, and Python 3.10.7 releases, CPython release artifacts are additionally signed with Sigstore (in addition to existing GPG signatures).

This page provides guidance on verifying Sigstore signatures as a CPython consumer, and outlines some motivation for using these additional signatures.

Sigstore verification of CPython Releases

Introduction to Sigstore

Sigstore is a new standard for signing, verifying and protecting software. The Sigstore project is a set of tools and services:

At a high level, Sigstore uses a certificate authority to tie OpenID Connect (OIDC) identities to ephemeral keys, and uses a transparency log to publish the results of signing events. This eliminates the need for signers to manage private keys. It also allows users to verify signatures based on characteristics of the OIDC identities, such as an email address.

More detail about the signing process and the interplay of these tools and services is provided in the Sigstore docs. Additionally, a security model for Sigstore can be found here.

Verifying CPython release artifacts with Sigstore

Verification requires the presence of three files: the release artifact in question, the signature, and the certificate (the last two together are called the “verification materials”. For example, for the Python 3.10.7 source release, you would download the following three files:

$ wget https://www.python.org/ftp/python/3.10.7/Python-3.10.7.tgz
$ wget https://www.python.org/ftp/python/3.10.7/Python-3.10.7.tgz.sig
$ wget https://www.python.org/ftp/python/3.10.7/Python-3.10.7.tgz.crt

These verification materials should exist for all release artifacts, and are listed on the downloads page along with their corresponding artifacts.

Verification additionally requires prior knowledge of the identity of the signer. For CPython releases, these are the @python.org email addresses of the release manager for the given release. The release managers for current and upcoming releases are as follows:

Release PEP Release manager
3.7 PEP 537 pablogsal@python.org*
3.8 PEP 569 lukasz@python.org
3.9 PEP 596 lukasz@python.org
3.10 PEP 619 pablogsal@python.org
3.11 PEP 664 pablogsal@python.org
3.12 PEP 693 thomas@python.org
  • While nad@python.org is the 3.7 release manager, future releases will be signed by pablogsal@python.org

Finally, verification requires a Sigstore client. Using https://pypi.org/p/sigstore/ is recommended:

To install with additional install-time assurances including hash-checking and version pinning, you can run the following to install from a fully specified requirements file:

$ python -m pip install -r https://raw.githubusercontent.com/sigstore/sigstore-python/main/install/requirements.txt

Alternatively, to install as usual without these assurances:

$ python -m pip install sigstore

Finally, in the directory where you downloaded the release artifact and verification materials, you can run the following:

$ python -m sigstore verify \
  --certificate Python-3.10.7.tgz.crt \
  --signature Python-3.10.7.tgz.sig \
  --cert-email pablogsal@python.org \
  Python-3.10.7.tgz

Running this command should result in the output OK: Python-3.10.7.tgz, which indicates that the signature is valid.

(Note that in addition to verifying the signature and certificate, this command performs an online verification that there is a corresponding entry in the signature transparency log as well. Offline verification is not yet supported)