sethmlarson

# MIT License
#
# Copyright (c) 2023 Seth Michael Larson
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:

sethmlarson

PSF CNA Onboarding

CNA Onboarding Videos

Watch all the informational videos from the CNA onboarding documentation. Approximately an hour of content about the program, becoming a CNA, assigning CVE IDs, and creating CVE records. Slides are available on the website.

• CVE Program Overview (5 minutes)
• Becoming a CNA (15 minutes)
• Assigning CVE IDs (26 minutes)

sethmlarson

{
    "$id": "https://spec.openapis.org/oas/3.1/schema/2022-10-07",
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "description": "The description of OpenAPI v3.1.x documents without schema validation, as defined by https://spec.openapis.org/oas/v3.1.0",
    "type": "object",
    "properties": {
      "$schema": {
        "type": "string"
      },
      "openapi": {

sethmlarson

SLSA + Python Notes

Created example project: https://github.com/sethmlarson/python-slsa-release-test

Python doesn't have a specific builder yet. Only have source attestation using the generic builder. Used: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml

Attestation "subject.name" is taken as input from sha256sum, so check the output of that to ensure it's what you want (ie package.tar.gz vs dist/package.tar.gz) For this I had to include a cd dist/ && before the sha256sum * call. Not sure where this matters though?

Success:

sethmlarson

import ssl
import requests
from requests.adapters import HTTPAdapter
import truststore

class TruststoreAdapter(HTTPAdapter):
    def init_poolmanager(
        self, *args, **kwargs
    ):
        ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

sethmlarson

import asyncio as A,urllib.parse as U,re;B,C,I,S=b"",b"\r\n",int,lambda*A:re.match(*A,24).groups()
async def request(m,u,h,b):
 s,_,a,_,q,_=z=U.urlparse(u);T,E,d,N=s!=b"http",0,B,z.hostname;r,w=await A.open_connection(N,I(z.port or 80+363*T),ssl=T,server_hostname=[None,N][T]);w.write(m+b" "+(a or b"/")+[b"?"+q,B][q==B]+b" HTTP/1.0"+C+C.join([b"%b:%b"%W for W in h]+[B,b]));await w.drain()
 while c:=await r.read():
  if C*2in(d:=d+c)*(E==0):E,d=d.split(C*2,1);t,o=S(b"HTTP/.+? (\d+).*?%b(.*)"%C,E);o=[S(rb"([^\s]+):\s*(.+?)\s*$",x)for x in o.split(C)]
 w.close();return I(t),o,d

sethmlarson

diff --git a/setup.py b/setup.py
index f804932..12ae724 100644
--- a/setup.py
+++ b/setup.py
@@ -1,11 +1,43 @@
 #!/usr/bin/env python
+import platform
+import sys
 from setuptools import find_packages, setup
+from setuptools.command.build_ext import build_ext

sethmlarson

import inspect
import sys
from pathlib import Path


def warn_stacklevel() -> int:
    """Dynamically determine stacklevel for warnings based on the call stack"""
    try:
        # Grab the root module from the current module '__name__'
        module_name = __name__.partition(".")[0]

sethmlarson

sethmlarson

PyPI TUF Key Generation and Signing Ceremony

Attesting that I was watching and listening to the live stream of the ceremony on Youtube for the entire duration of the broadcast without interruption. Notes were taken as I went with a stopwatch keeping track of relative timestamps from the start of the ceremony.

All times are of my viewing of the ceremony, not necessarily as the ceremony actually occurred due to delay between real events and the stream.