Ergonomic Codesigning for the Python Ecosystem with Sigstore

Explore the future of code signing in the Python packaging ecosystem through this PyCon US talk by William Woodruff. Dive into the world of Sigstore, a revolutionary approach that allows package maintainers and users to sign and verify the authenticity of Python packages without the complexities of PGP. Gain insights into the cryptographic fundamentals of code signing and understand how Sigstore eliminates the need for long-term key material. Learn about the ongoing efforts to integrate Sigstore into Python packaging, including the standardization process and foundational work required for introducing a new code signing format. Discover the security model of Sigstore and the guarantees it provides for the Python packaging ecosystem. Get a comprehensive overview of the current state of Sigstore for Python, future goals, and ways to contribute to this important initiative in supply chain security.