Incorrect information in `https://www.python.org/download/sigstore/`

[ned-deily]

As requested on the web page, I am reporting issues with the page here, although long-term I think this page should be maintained by the Python release management team. One problem is that not all release managers use accounts.google.com as the cert-oidc-issuer so the directions given fail for 3.9, 3.8, and 3.7 releases at least. Also, the information about 3.7 releases is incorrect. Only the first sigstore signed 3.7 release was signed by pablogsal@python.org; all subsequent and future 3.7 release have been / will be signed by the 3.7 RM nad@python.org.

[woodruffw]

Thanks @ned-deily!

I think this falls under the discussion in #567 -- it's currently pretty easy for signers to sign with the "wrong" identity/issuer combination from a policy perspective, since sigstore-python itself (currently) has no way to limit which options are available during the federated OAuth flow.

Apart from fixing the documentation on https://python.org, we probably need a way for the sigstore CLI to accept more complex verification policies (e.g. of multiple identities ORed together). That functionality is present in the underlying sigstore-python APIs, but we don't currently have a clean way to expose it to the CLI.

[di]

Thanks @ned-deily. We have a few options short term to get the docs up to date:

• we make sure everyone uses the same IdP in the future and re-sign any release that isn't signed with the right identity -- this can include the 3.7 release that you didn't sign; or:
• we update the verification steps to include a matrix of artifact x identity + IdP

I think I would prefer the first option because it would make the verification steps simpler for consumers, but this would be at the cost of some one-time work for the release managers. Curious for your thoughts!

[di]

Looping in @sethmlarson here, as he should probably be the primary owner of this page going forward.

(Also, sigstore/sig-clients#7 is likely relevant here as well.)

[sethmlarson]

I went through all the Python releases and attempted Sigstore verification as is documented on the release page like so:

$ python -m sigstore verify identity \
  --certificate {filename}.crt \
  --signature {filename}.sig \
  --cert-identity {release_manager} \
  --cert-oidc-issuer https://accounts.google.com \
  {filename}

or

$ python -m sigstore verify identity \
  --bundle {filename}.sigstore \
  --cert-identity {release_manager} \
  --cert-oidc-issuer https://accounts.google.com \
  {filename}

Here are the results:

Artifact	Method	Documented RM	Verified?	Reason
Python-3.7.14.tar.xz	.sig+.crt	nad@python.org	FAIL	Certificate's SANs do not match nad@python.org; actual SANs: {'pablogsal@python.org'}
Python-3.7.14.tgz	.sig+.crt	nad@python.org	FAIL	Certificate's SANs do not match nad@python.org; actual SANs: {'pablogsal@python.org'}
Python-3.7.15.tar.xz	.sig+.crt	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.15.tgz	.sig+.crt	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.16.tar.xz	.sig+.crt	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.16.tgz	.sig+.crt	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.17.tar.xz	.sig+.crt	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.17.tar.xz	.sigstore	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.17.tgz	.sig+.crt	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.7.17.tgz	.sigstore	nad@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.0a1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0a1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0a2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0a2.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0a3.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0a3.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0a4.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0a4.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0b1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0b1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0b2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0b2.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0b3.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0b3.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0b4.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0b4.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.0.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.0.tgz	N/A	lukasz@python.org	N/A
Python-3.8.1rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.1rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.2rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.2rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.2rc2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.2rc2.tgz	N/A	lukasz@python.org	N/A
Python-3.8.2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.2.tgz	N/A	lukasz@python.org	N/A
Python-3.8.3rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.3rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.3.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.3.tgz	N/A	lukasz@python.org	N/A
Python-3.8.4rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.4rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.4.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.4.tgz	N/A	lukasz@python.org	N/A
Python-3.8.5.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.5.tgz	N/A	lukasz@python.org	N/A
Python-3.8.6rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.6rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.6.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.6.tgz	N/A	lukasz@python.org	N/A
Python-3.8.7rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.7rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.7.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.7.tgz	N/A	lukasz@python.org	N/A
Python-3.8.8rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.8rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.8.8.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.8.tgz	N/A	lukasz@python.org	N/A
Python-3.8.9.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.9.tgz	N/A	lukasz@python.org	N/A
Python-3.8.10.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.10.tgz	N/A	lukasz@python.org	N/A
Python-3.8.11.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.11.tgz	N/A	lukasz@python.org	N/A
Python-3.8.12.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.12.tgz	N/A	lukasz@python.org	N/A
Python-3.8.13.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.13.tgz	N/A	lukasz@python.org	N/A
Python-3.8.14.tar.xz	N/A	lukasz@python.org	N/A
Python-3.8.14.tgz	N/A	lukasz@python.org	N/A
Python-3.8.15.tar.xz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.15.tgz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.16.tar.xz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.16.tgz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.17.tar.xz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.17.tar.xz	.sigstore	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.17.tgz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.8.17.tgz	.sigstore	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.0a1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0a1.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0a2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0a2.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0a3.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0a3.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0a4.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0a4.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0a5.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0a5.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0a6.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0a6.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0b1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0b1.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0b2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0b2.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0b3.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0b3.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0b4.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0b4.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0b5.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0b5.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0rc2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0rc2.tgz	N/A	lukasz@python.org	N/A
Python-3.9.0.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.0.tgz	N/A	lukasz@python.org	N/A
Python-3.9.1rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.1rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.9.1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.1.tgz	N/A	lukasz@python.org	N/A
Python-3.9.2rc1.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.2rc1.tgz	N/A	lukasz@python.org	N/A
Python-3.9.2.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.2.tgz	N/A	lukasz@python.org	N/A
Python-3.9.3.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.3.tgz	N/A	lukasz@python.org	N/A
Python-3.9.4.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.4.tgz	N/A	lukasz@python.org	N/A
Python-3.9.5.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.5.tgz	N/A	lukasz@python.org	N/A
Python-3.9.6.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.6.tgz	N/A	lukasz@python.org	N/A
Python-3.9.7.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.7.tgz	N/A	lukasz@python.org	N/A
Python-3.9.8.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.8.tgz	N/A	lukasz@python.org	N/A
Python-3.9.9.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.9.tgz	N/A	lukasz@python.org	N/A
Python-3.9.10.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.10.tgz	N/A	lukasz@python.org	N/A
Python-3.9.11.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.11.tgz	N/A	lukasz@python.org	N/A
Python-3.9.12.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.12.tgz	N/A	lukasz@python.org	N/A
Python-3.9.13.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.13.tgz	N/A	lukasz@python.org	N/A
Python-3.9.14.tar.xz	N/A	lukasz@python.org	N/A
Python-3.9.14.tgz	N/A	lukasz@python.org	N/A
Python-3.9.15.tar.xz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.15.tgz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.16.tar.xz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.16.tgz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.17.tar.xz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.17.tar.xz	.sigstore	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.17.tgz	.sig+.crt	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.9.17.tgz	.sigstore	lukasz@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.10.0a1.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a1.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0a2.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a2.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0a3.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a3.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0a4.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a4.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0a5.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a5.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0a6.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a6.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0a7.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0a7.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0b1.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0b1.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0b2.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0b2.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0b3.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0b3.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0b4.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0b4.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0rc1.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0rc1.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0rc2.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0rc2.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.0.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.0.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.1.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.1.tar.xz	.sigstore	pablogsal@python.org	PASS
Python-3.10.1.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.1.tgz	.sigstore	pablogsal@python.org	PASS
Python-3.10.2.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.2.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.3.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.3.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.4.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.4.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.5.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.5.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.6.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.10.6.tgz	N/A	pablogsal@python.org	N/A
Python-3.10.7.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.7.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.8.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.8.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.9.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.9.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.10.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.10.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.11.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.11.tar.xz	.sigstore	pablogsal@python.org	PASS
Python-3.10.11.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.11.tgz	.sigstore	pablogsal@python.org	PASS
Python-3.10.12.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.12.tar.xz	.sigstore	pablogsal@python.org	PASS
Python-3.10.12.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.10.12.tgz	.sigstore	pablogsal@python.org	PASS
Python-3.11.0a1.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a1.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0a2.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a2.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0a3.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a3.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0a4.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a4.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0a5.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a5.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0a6.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a6.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0a7.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0a7.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0b1.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0b1.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0b2.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0b2.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0b3.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0b3.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0b4.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0b4.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0b5.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0b5.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0rc1.tar.xz	N/A	pablogsal@python.org	N/A
Python-3.11.0rc1.tgz	N/A	pablogsal@python.org	N/A
Python-3.11.0rc2.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.0rc2.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.0.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.0.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.1.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.1.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.2.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.2.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.3.tar.xz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.3.tar.xz	.sigstore	pablogsal@python.org	PASS
Python-3.11.3.tgz	.sig+.crt	pablogsal@python.org	PASS
Python-3.11.3.tgz	.sigstore	pablogsal@python.org	PASS
Python-3.11.4.tar.xz	.sig+.crt	pablogsal@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.11.4.tar.xz	.sigstore	pablogsal@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.11.4.tgz	.sig+.crt	pablogsal@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.11.4.tgz	.sigstore	pablogsal@python.org	FAIL	Certificate's OIDCIssuer does not match (got https://github.com/login/oauth, expected https://accounts.google.com)
Python-3.12.0a1.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a1.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a2.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a2.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a3.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a3.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a4.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a4.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a5.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a5.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a6.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a6.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a7.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a7.tar.xz	.sigstore	thomas@python.org	PASS
Python-3.12.0a7.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0a7.tgz	.sigstore	thomas@python.org	PASS
Python-3.12.0b1.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b1.tar.xz	.sigstore	thomas@python.org	PASS
Python-3.12.0b1.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b1.tgz	.sigstore	thomas@python.org	PASS
Python-3.12.0b2.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b2.tar.xz	.sigstore	thomas@python.org	PASS
Python-3.12.0b2.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b2.tgz	.sigstore	thomas@python.org	PASS
Python-3.12.0b3.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b3.tar.xz	.sigstore	thomas@python.org	PASS
Python-3.12.0b3.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b3.tgz	.sigstore	thomas@python.org	PASS
Python-3.12.0b4.tar.xz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b4.tar.xz	.sigstore	thomas@python.org	PASS
Python-3.12.0b4.tgz	.sig+.crt	thomas@python.org	PASS
Python-3.12.0b4.tgz	.sigstore	thomas@python.org	PASS

Looking at the results I see a few things:

• We're missing Sigstore signing for Python 3.10.0 and 3.10.2-3.10.6
• We started signing pre-releases in 3.11.0rc2
• Ned and Lukasz used GitHub for all signings, Pablo used GitHub for some signings

My questions for next steps are:

• Should we always used Google IdP for Sigstore signing for python.org addresses (my thought is probably? Simplifies verification for users to only use one IdP)
• Should we make a policy of signing pre-releases (My thought is yes)
• What needs to be done for sigstore sig/crt/sigstore files be updated in-place at downloads.python.org for existing releases (assuming that's possible)? Probably some blog post so we have something official to point folks to when their signatures change?

[ned-deily]

The other release managers (Thomas, Pablo, and Łukasz) should be part of this discussion since we have had some discussions about this at PyCon and on email. But I don't seem to be able to add them here.

[sethmlarson]

cc @Yhg1s @pablogsal @ambv

[ned-deily]

FWIW, I wasn't keen on adding yet another identity (the google.com one) to the release process since I was already using the GitHub identity elsewhere. And the 3.7.14 signing by Pablo was a one-time expediting action; the artifacts could be re-signed.

[sethmlarson]

Since Python 3.7 is EOL at this point too, there's an additional decision about whether we want to touch those releases at all anymore?

If we decided to only rollout fixes for 3.8 and beyond the concrete steps per person would look like this (assuming we do want to use accounts.google.com uniformly as our IdP):

• @ambv: Resign all the releases (6 total) with the Google IdP
• @pablogsal: Resign 3.11.4 with the Google IdP

Then I would take it as an action to add a verification step to python/release-tools to verify that the signatures work as we're documenting on the release page. If we decide to go this way I can put together a short script for both @ambv and @pablogsal to download, hash, and then resign and they can ship back the resulting signatures to me to be published all at once. If we do want to fix the signatures for 3.7 I can also create a script for you @ned-deily to run on the relevant releases.

While this is happening I can prepare the communications announcing this fix to release signatures.

[di]

Should we always used Google IdP for Sigstore signing for python.org addresses (my thought is probably? Simplifies verification for users to only use one IdP)

Note that now that #567 is resolved, we can enforce the IdP at signing time, but sounds like exclusively using the Google IdP is a non-starter for @ned-deily IIUC.

Until sigstore/sig-clients#7 is resolved, and there is a way for clients to define a policy for what (identity, issuer) pair is valid, I think the best we can do is provide a table of (identity, issuer) pairs for all signers.

One alternative that was discussed was creating a new, shared identity between all the release managers (this could be on any of the identity providers) so verification is simplified, and this doesn't require individual release managers to sign.

[sethmlarson]

I think the best we can do is provide a table of (identity, issuer) pairs for all signers.

Happy to go this route too, for this case we'd have 3.7.14 resigned by @ned-deily and (3.10.0, 3.10.2-3.10.6, and 3.11.4) signed by @pablogsal with Google IdP (assuming you want to use Google going forward Pablo). Can capture these in the release-tool just as well.

[pablogsal]

(assuming you want to use Google going forward Pablo)

Yup. This is the one I have always used. I am a bit surprised there are mismatches here because I have always used the google one with pablogsal@python.org

[ned-deily]

I've regenerated the sigstore files for 3.7.14 to use nad@python.org and GitHub like subsequent 3.7.x releases and added a note to the 3.7.14 release page that the sigstore files were updated today while the release tarballs were unchanged.

[sethmlarson]

Thanks @ned-deily! @pablogsal if you can resign the releases I noted with the Google IdP I can update the table for the sigstore page with identity providers for each RM.