Bug#1084157: RFP: sigstore-python -- sigstore is a Python tool for generating and verifying Sigstore signatures

[Stefano Rivera <stefanor@debian.org>]

Package: wnpp
Severity: wishlist

* Package name    : sigstore-python
  Version         : 3.3.0
  Upstream Contact: Sigstore Authors <sigstore-dev@googlegroups.com>
* URL             : https://github.com/sigstore/sigstore-python
* License         : Apache-2.0
  Programming Lang: Python
  Description     : sigstore is a Python tool for generating and verifying Sigstore signatures

Features:

*  Support for keyless signature generation and verification with Sigstore
*  Support for signing with "ambient" OpenID Connect identities
*  A comprehensive CLI and corresponding importable Python API

See recent debian-devel discussion: https://lists.debian.org/msgid-search/20241004182101.lnc5dqft4vurbcrh@satie.tumbleweed.org.za

Looking at pyproject.toml, there are a few dependencies that need to
come first:

  "sigstore-protobuf-specs == 0.3.2",
  "sigstore-rekor-types == 0.0.13",
  "tuf ~= 5.0",