Post

Today we're unveiling new Software Supply Chain features for the Conda ecosystem: the integration of Sigstore is in public beta on prefix! You can now create Sigstore attestations on Github Actions and cryptographically secure your supply chain with trusted publishing.

Prefix.dev - the Pixi company

@prefix.dev

1 Sept 2025

Check out our blog post explaining how we worked with the Conda community towards CEP-27 and how our Sigstore implementation works under the hood. We are now offering the "worlds most advanced Conda channels"! prefix.dev/blog/securi...

prefix.devSecuring the Conda Package Supply Chain with SigstoreWe're pleased to announce that sigstore support is now in public beta on prefix.dev! The Conda ecosystem can now use Sigstore to enhance the Software Supply Chain Security with cryptographic attestations.

Prefix.dev - the Pixi company

@prefix.dev

1 Sept 2025

This example perfectly shows how easy it is to cryptographically attest who built a given package thanks to Sigstore and upload it using rattler-build to prefix: github.com/prefix-dev/...

github.comGitHub - prefix-dev/sigstore-example: Signing a Conda package with Sigstore and uploading it to prefix.devSigning a Conda package with Sigstore and uploading it to prefix.dev - prefix-dev/sigstore-example

Prefix.dev - the Pixi company

@prefix.dev

We are full of ideas on how to expand on this and already excited to continue this work with funding from an OpenSSF technical initiative. Also, thanks to Trail Of Bits who made the CEP-27 enhancement proposal extremely solid thanks to their depth of knowledge.

1/9/25, 2:37 pm0 reposts0 likes

No replies yet.