sigstore-protobuf-specs

What it is and what it does

This package contains compiled Python protobuf message definitions for Sigstore, the open-source project for cryptographic artifact signing and verification. It provides the serialization and deserialization code needed to work with Sigstore's standard message formats, including support for cryptographic keys, signatures, and verification material. The package is built from `.proto` specifications and includes generated Python stubs using betterproto and pydantic for validation.

It is primarily a dependency for tools and libraries that integrate with the Sigstore ecosystem—such as clients that need to communicate with Sigstore services (Fulcio, Rekor) or applications that verify signed artifacts. The package supports modern Python versions (3.7 through 3.11) and is actively maintained by the Sigstore community, with ongoing work to support new post-quantum cryptography algorithms.

Use it for:

• Building Sigstore client libraries that need to serialize and deserialize signing requests and verification responses.
• Integrating artifact signing workflows into CI/CD pipelines that use Sigstore for supply-chain security.
• Implementing custom verification logic for Sigstore-signed artifacts in Python applications.
• Developing tools that interact with Sigstore services like Rekor (transparency log) or Fulcio (certificate authority).

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides Python protobuf message definitions and serialization code for Sigstore cryptographic signing and verification workflows.

Yes, if you are building or integrating with Sigstore tooling. This is a foundational dependency for any Python application that needs to work with Sigstore's message formats. Install friction is minimal and maintenance is active. No security vulnerabilities are known. If you are not working with Sigstore directly, you likely do not need this package.

Install

sigstore-protobuf-specs on PyPI

pip install sigstore-protobuf-specs

uv add sigstore-protobuf-specs

poetry add sigstore-protobuf-specs

Installing sigstore-protobuf-specs

Before you install

Low install friction with only two runtime dependencies (betterproto and pydantic). Actively maintained with a recent release on 2026-04-06 and last commit on 2026-08-10.

License in practice

Licensed under Apache Software License (permissive), allowing commercial and private use without restriction.

Quickstart

pip install sigstore-protobuf-specs

from sigstore_protobuf_specs.gen.python import sigstore_common

# Use protobuf message definitions for Sigstore workflows

Requires Python 3.8 or later; depends on betterproto and pydantic at runtime.

Verify before relying

• Whether the package is intended for end-user applications or primarily for Sigstore ecosystem tooling
• Performance characteristics when serializing/deserializing large message volumes
• Stability guarantees for the protobuf schema across minor version updates

Package facts

Evidence: sigstore_protobuf_specs-0.5.1-py3-none-any.whl

Tags

More Security packages