Registry / auth-security / in-toto-attestation

in-toto-attestation

library0.9.3pypypiunverified

Python bindings for the in-toto Attestation Framework. This library provides models and serialization for creating, verifying, and bundling software attestations according to the in-toto specification (v1.0+). Current version is 0.9.3 on PyPI, but the library is under active development with GitHub releases up to v1.2.0. The PyPI package lags behind the specification releases; users should prefer the latest GitHub release for up-to-date functionality.

auth-security serialization data

pip install in-toto-attestation

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · IN-TOTO-ATTESTATIO

in-toto-attestation

auth-securitypythonv0.9.3

Install

—

Import

—

Disk

—

Pass rate

0/ 10

Env Coverage0 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.9.3 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

glibc

py 3.10

1/2 runs

py 3.11

1/2 runs

py 3.12

1/2 runs

py 3.13

1/2 runs

py 3.9

1/2 runs

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Statement

✓ from in_toto_attestation import Statement

✗ from in_toto_attestation.v1 import Statement

Create a simple in-toto Statement and serialize it to JSON.

from in_toto_attestation.v1 import Statement from in_toto_attestation.v1.attestation import Attestation from in_toto_attestation.v1.resource_descriptor import ResourceDescriptor import json sub = ResourceDescriptor(name='example', digest={'sha256': 'abc123'}) stmt = Statement(subject=[sub], predicate_type='https://example.com/predicate/v1') print(json.dumps(stmt.to_dict(), indent=2))

Debug

Known issues

gotchaPyPI package (0.9.3) is outdated and does not include v1.1+ features like the Bundle type or newer predicate types. Always check if the GitHub release is newer and install from source if needed.

fix

Install from GitHub: pip install git+https://github.com/in-toto/attestation.git@v1.2.0

affects: <=0.9.3

breakingIn v1.0.0, the API changed significantly from older 0.x versions. The whole module structure moved under in_toto_attestation.v1. Old imports from in_toto_attestation directly will break.

fix

Use from in_toto_attestation.v1 import Statement (and other classes).

affects: >=1.0.0

deprecatedThe 'DigestSet' field type is now generalized to 'DigestSet' supporting any immutable identifier (not just cryptographic). Existing code using DigestSet with only cryptographic digests remains compatible but may need to update validation logic.

fix

Update DigestSet usage to accept non-cryptographic digests if needed.

affects: <1.1.0

gotchaSerialization to JSON uses to_dict() method, not .json() or .serialize(). Always call to_dict() before json.dumps().

fix

Use stmt.to_dict() then json.dumps(...).

affects: >=0.9.3

Upgrade

Version history

0.9.3latest on PyPI · released Dec 13, 2023

Audit

Dependencies

No dependency data recorded yet.

Agent activity

19 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/in-toto/attestation ↗

packagehttps://pypi.org/project/in-toto-attestation/ ↗

homepagehttps://in-toto.io ↗