I’m working on adding generic Redfish support to Home Assistant. PR #190 added the asynchronous aiohttp client that Home Assistant needs but Home Assistant’s dependency review also flagged the way the redfish package is currently published.
The existing release workflow is started manually, updates the version and changelog, pushes those changes to main, builds the package, and uploads it using the PYPI_API_TOKEN secret. As a result, the files published for 3.3.9 do not include
PyPI provenance attestations. Home Assistant’s dependency-transparency requirement for new integrations expects the release process and its relationship to the published artifacts to be publicly verifiable.
@mraineri any thoughts / issues / concerns with changing this build process?
I took a stab at this with a draft PR: #193
The proposed workflow expects the version and changelog changes to be reviewed and merged before the release. Publishing a GitHub release then builds from that release tag in an unprivileged job. A separate publishing job uses GitHub OIDC instead
of a stored PyPI token and uploads provenance attestations with the distributions.
A DMTF or PyPI project maintainer would need to perform the one-time trusted publisher setup for:
- Owner:
DMTF
- Repository:
python-redfish-library
- Workflow:
main.yml
- Environment:
pypi
The Home Assistant review that raised the issue: home-assistant/core#177991 (comment)
I’m working on adding generic Redfish support to Home Assistant. PR #190 added the asynchronous
aiohttpclient that Home Assistant needs but Home Assistant’s dependency review also flagged the way theredfishpackage is currently published.The existing release workflow is started manually, updates the version and changelog, pushes those changes to
main, builds the package, and uploads it using thePYPI_API_TOKENsecret. As a result, the files published for 3.3.9 do not includePyPI provenance attestations. Home Assistant’s dependency-transparency requirement for new integrations expects the release process and its relationship to the published artifacts to be publicly verifiable.
@mraineri any thoughts / issues / concerns with changing this build process?
I took a stab at this with a draft PR: #193
The proposed workflow expects the version and changelog changes to be reviewed and merged before the release. Publishing a GitHub release then builds from that release tag in an unprivileged job. A separate publishing job uses GitHub OIDC instead
of a stored PyPI token and uploads provenance attestations with the distributions.
A DMTF or PyPI project maintainer would need to perform the one-time trusted publisher setup for:
DMTFpython-redfish-librarymain.ymlpypiThe Home Assistant review that raised the issue: home-assistant/core#177991 (comment)