{"categories":[{"label":"Software Development","url":"https://skillfed.io/packages/category/software-development/6"},{"label":"Security","url":"https://skillfed.io/packages/category/security"}],"enrichment":{"capability":"Securesystemslib provides a cryptography interface for creating and verifying digital signatures, with support for ed25519, RSA, ECDSA, and hardware security modules, designed for TUF and in-toto metadata formats.","skillfed_tags":["supply-chain-security","tuf-in-toto","hardware-keys"],"use_cases":["Verify software package authenticity in supply-chain security tools by checking TUF or in-toto metadata signatures.","Sign and verify release artifacts or deployment manifests in CI/CD pipelines using a unified cryptographic interface.","Integrate hardware security module keys (e.g., Yubikeys) into applications without writing HSM-specific code.","Build secure update frameworks that need to support multiple signature schemes without tight coupling to any one backend.","Migrate legacy key formats to a standard format compatible with modern signing workflows."],"what_it_does":"Securesystemslib is a cryptography interface library that abstracts digital signing and verification operations. It sits between your application and various cryptographic backends\u2014pure-Python ed25519, the cryptography library for RSA and ECDSA, and hardware security modules like Yubikeys\u2014allowing you to work with a unified API regardless of which signing system you choose. The library was built specifically for TUF (The Update Framework) and in-toto projects, so its key and signature containers are compatible with those projects' metadata formats.\n\nThe default installation provides ed25519 signature verification only. To enable signature creation or other schemes (RSA, ECDSA), you install with extras like `[crypto]` or `[hsm]`. It has no runtime dependencies in its base form, making it lightweight to add to a project. The library is actively maintained, supports modern Python versions (3.10 through 3.14), and carries an MIT license.","worth_installing":"Yes. Securesystemslib is worth installing if you need to sign or verify digital signatures in a supply-chain or software-integrity context. It is actively maintained, has no base dependencies, carries a permissive MIT license, and is purpose-built for TUF and in-toto workflows. Install with extras (`[crypto]` or `[hsm]`) only if you need signature creation or hardware key support."},"id":"securesystemslib","links":{"html":"https://skillfed.io/packages/securesystemslib","md":"https://skillfed.io/packages/securesystemslib.md","pypi":"https://pypi.org/project/securesystemslib/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-05-27","license_spdx":"MIT","license_treatment":"permissive","name":"securesystemslib","python_support":"supports_current","summary":"A library that provides cryptographic and general-purpose routines for Secure Systems Lab projects at NYU"},"popularity":{"monthly_downloads":1065950,"position":4415,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"1.4.0"}