Developers of the Python Paki Pypi (Python Package Index) announced the introduction of support for digital certification to verify the authenticity of published packages. This new mechanism replaced the previous verification using PGP signatures. The key difference with digital certification is that packages published are certified by a third-party catalog of packages after confirmation of reliability from the external provider Openid Connect, ensuring correlation with the associated repository on platforms like Github or Gitlab.
The decision to implement this new certification system was made to address the shortcomings of the outdated PGP signature verification process in Pypi. Issues with verifying ownership through open PGP keys led to unreliable authentication. Out of 1069 PGP keys used in subscriptions since 2020, 29% were missing from public key servers, and 35% of the keys were unverifiable. Only 0.3% of signed files were actually confirmed.
In the new system, ephemeral keys generated by Openid Connect providers are used to create signatures certifying packages. Developers are required to verify their identity through the Openid provider when generating these keys. Infrastructure for digital certification is built using Sigstore and tools from the in-toto attestation framework.
One of the key advantages of certification is the lack of dependence on a fixed PGP key. This eliminates the loss of trust in signatures due to compromised keys. With certification, the signature is linked to a token confirming authority at the time of package submission and connection to the main repository. For instance, certification can verify the relationship between a file, repository, workflow process, and Hash Commit when a package is prepared with GitHub Action.
To ensure the authenticity of keys and detect potential compromises in projects and PYPI, a centralized public log is utilized. This log maintains integrity and protects against data manipulation using