---
id: sigstore-protobuf-specs
version: "0.5.1"
license: unclear
license_treatment: permissive
maintenance: active
---

# sigstore-protobuf-specs — A library for serializing and deserializing Sigstore messages

License: permissive · Maintenance: active · Downloads: 104.2K/mo

## What it is and what it does

This package contains compiled Python protobuf message definitions for Sigstore, the open-source project for cryptographic artifact signing and verification. It provides the serialization and deserialization code needed to work with Sigstore's standard message formats, including support for cryptographic keys, signatures, and verification material. The package is built from `.proto` specifications and includes generated Python stubs using betterproto and pydantic for validation.

It is primarily a dependency for tools and libraries that integrate with the Sigstore ecosystem—such as clients that need to communicate with Sigstore services (Fulcio, Rekor) or applications that verify signed artifacts. The package supports modern Python versions (3.7 through 3.11) and is actively maintained by the Sigstore community, with ongoing work to support new post-quantum cryptography algorithms.

Use it for:

- Building Sigstore client libraries that need to serialize and deserialize signing requests and verification responses.
- Integrating artifact signing workflows into CI/CD pipelines that use Sigstore for supply-chain security.
- Implementing custom verification logic for Sigstore-signed artifacts in Python applications.
- Developing tools that interact with Sigstore services like Rekor (transparency log) or Fulcio (certificate authority).

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides Python protobuf message definitions and serialization code for Sigstore cryptographic signing and verification workflows.

Yes, if you are building or integrating with Sigstore tooling. This is a foundational dependency for any Python application that needs to work with Sigstore's message formats. Install friction is minimal and maintenance is active. No security vulnerabilities are known. If you are not working with Sigstore directly, you likely do not need this package.

## Install

pip install sigstore-protobuf-specs
uv add sigstore-protobuf-specs
poetry add sigstore-protobuf-specs

## Installing sigstore-protobuf-specs

Before you install: Low install friction with only two runtime dependencies (betterproto and pydantic). Actively maintained with a recent release on 2026-04-06 and last commit on 2026-08-10.

License in practice: Licensed under Apache Software License (permissive), allowing commercial and private use without restriction.

Quickstart:

pip install sigstore-protobuf-specs

from sigstore_protobuf_specs.gen.python import sigstore_common

# Use protobuf message definitions for Sigstore workflows

Requires Python 3.8 or later; depends on betterproto and pydantic at runtime.

Verify before relying:

- Whether the package is intended for end-user applications or primarily for Sigstore ecosystem tooling
- Performance characteristics when serializing/deserializing large message volumes
- Stability guarantees for the protobuf schema across minor version updates

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 104.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

sigstore protobuf messages, protobuf specs cryptography, sigstore serialization, protobuf definitions signing, sigstore message format, protobuf cryptographic artifacts, sigstore, protobuf, supply-chain-security

[View on SkillFed](https://skillfed.io/packages/sigstore-protobuf-specs) · [View on PyPI](https://pypi.org/project/sigstore-protobuf-specs/)