feat(python): add GitHub provenance verification for prebuilt binaries#8820

Merged

jdx merged 10 commits intojdx:mainfrom

malept:feat/python-provenance-verification

Mar 30, 2026

Commits on Mar 30, 2026

feat(python): add python.github_attestations setting
malept
committed
feat(python): pre-record GithubAttestations provenance in lockfile
malept
committed
feat(python): verify GitHub attestations and enforce provenance at install time
malept
committed
test(python): add e2e tests for provenance verification and downgrade protection
malept
committed
refactor(python): extract github_attestations_enabled helper to reduce duplication
malept
committed
feat(python): add security_info override for GitHub attestations reporting
malept
committed
docs: add core:python to lockfile provenance support list
malept
committed
fix(python): disable attestation verification in e2e tests for older Python versions
malept
committed
test(python): add e2e test for GitHub artifact attestations verification
malept
committed
fix(python): guard detect_precompiled_provenance against compile=true
malept
committed