Kairo Francisco de Araujo: PEP 458 a solution not only for PyPI @ PyCon Ireland 2023 скачать в хорошем качестве

Kairo Francisco de Araujo: PEP 458 a solution not only for PyPI @ PyCon Ireland 2023

PEP 458 uses cryptographic signing on PyPI to protect Python packages against attackers. The implementation of the PEP inspired the Repository Service for TUF (RSTUF), a project accepted into the OpenSSF sandbox. We identified that the design could benefit other organizations and repositories looking to secure their software supply chains. In this talk we would answer the following questions: How did the PEP 458 design help to start the Repository Service for TUF (RSTUF)? How could RSTUF be used for PyPI with its millions of packages? How can RSTUF be deployed by any organization at any scale without requiring TUF expertise? Additionally, in this talk, we would give an overview of PEP 458, how it works, and give a high-level overview of TUF. GROUND FLOOR ROOM 1 Sat 11:10 am - 11:45 am