Registry / serialization / sigstore-protobuf-specs

sigstore-protobuf-specs

library0.5.1pypypiunverified

A library for serializing and deserializing Sigstore messages (e.g., Bundle, DSSE, Envelope). Published as a Python package at version 0.5.1, maintained by the Sigstore project. Requires Python >=3.8. Release cadence is irregular, tied to upstream protobuf spec changes.

serialization auth-security

pip install sigstore-protobuf-specs

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SIGSTORE-PROTOBUF-

sigstore-protobuf-specs

serializationpythonv0.5.1

Install

4.3s avg

Import

720ms

Disk

31MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.5.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.770s · 32.7MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 4.3s · import 0.670s · 32MB

31MB installed

● package 31MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Bundle

✓ from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle

✗ from sigstore_protobuf_specs.bundle import Bundle

Corrent path includes dev.sigstore.bundle.v1; wrong omits versioned subpackage.

DSSEEnvelope

✓ from sigstore_protobuf_specs.dev.sigstore.dsse import Envelope

✗ from sigstore_protobuf_specs.dsse import Envelope

Same versioned path issue; DSSE Envelope is under dev.sigstore.dsse.

HashAlgorithm

✓ from sigstore_protobuf_specs.dev.sigstore.common.v1 import HashAlgorithm

Common types also under versioned v1 subpackage.

Creates an empty Sigstore Bundle message using the official protobuf generated class.

from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle # Create an empty bundle bundle = Bundle() print(bundle)

Debug

Known issues

breakingImport paths changed in version 0.3.0: all protobuf messages are now under 'sigstore_protobuf_specs.dev.sigstore.*' with versioned subpackages (e.g., v1).

fix

Update imports to include 'dev' and version subpackage, e.g., 'from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle'.

affects: >=0.3.0

gotchaThe package only provides protobuf message classes (serialization/deserialization). It does NOT include Sigstore verification or signing logic. Users often mistakenly import this for operational tasks.

fix

For signing/verification, use the 'sigstore' package. This package is for low-level protobuf object manipulation.

affects: all

deprecatedDirect import from 'sigstore_protobuf_specs.sigstore.*' (without 'dev') was deprecated in 0.3.0 and removed in 0.4.0.

fix

Use the full path with 'dev.sigstore....'.

affects: >=0.4.0

Upgrade

Version history

0.5.1latest on PyPI · released Apr 6, 2026

Audit

Dependencies

protobufrequiredRuntime dependency for protobuf message types.

Agent activity

36 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/sigstore/protobuf-specs ↗

packagehttps://pypi.org/project/sigstore-protobuf-specs/ ↗

homepagehttps://pypi.org/project/sigstore-protobuf-specs/ ↗