Data

Tools

Indexes

Applications

Experiments

Open Source Science

https://github.com/conda/conda-content-trust

Signing and verification tools for conda

https://github.com/conda/conda-content-trust

Science Score: 26.0%

This score indicates how likely this project is to be science-related based on various indicators:

  • ○
    CITATION.cff file
  • ✓
    codemeta.json file
    Found codemeta.json file
  • ✓
    .zenodo.json file
    Found .zenodo.json file
  • ○
    DOI references
  • ○
    Academic publication links
  • ○
    Committers with academic emails
  • ○
    Institutional organization owner
  • ○
    JOSS paper metadata
  • ○
    Scientific vocabulary similarity
    Low similarity (16.0%) to scientific vocabulary

Keywords from Contributors

conda package-management archiving parallel pypi distributed plots energy-system-model packaging transformers
Last synced: 10 months ago · JSON representation

Repository

Signing and verification tools for conda

Basic Info
  • Host: GitHub
  • Owner: conda
  • License: other
  • Language: Python
  • Default Branch: main
  • Homepage:
  • Size: 521 KB
Statistics
  • Stars: 9
  • Watchers: 9
  • Forks: 12
  • Open Issues: 1
  • Releases: 2
Created over 6 years ago · Last pushed 10 months ago
Metadata Files
Readme Changelog License Code of conduct Authors

README.md

Conda Content Trust: Signing and verification tools for Conda

Tests (GitHub Actions) Codecov Status latest release version

What: Based on The Update Framework (TUF), conda-content-trust is intended to ensure that when users in the conda ecosystem obtain a package or data about that package, they can know whether or not it is trustworthy (e.g. originally comes from a reliable source and has not been tampered with). A basic library and basic CLI are included to provide signing, verification, and trust delegation functionality.

Why: This exists as an alteration of TUF because of the very particular needs of the conda ecosystem. (Developers are encouraged to just use TUF whenever possible!)

Where: This tool is general purpose. It is currently used in conda 4.10.1+ to verify package metadata signatures when they are available (announcement, instructions).

Installation

Installation can be accomplished via conda:

conda install conda-content-trust

Or via pip:

pip install conda-content-trust

(If you intend to tinker with the code, feel free to use an editable install: pip install -e .)

Optional Dependencies for Producing Signatures with GPG Keys / YubiKeys

If you intend to create GPG key signatures (as opposed to the typical non-GPG signatures), and/or you intend to use the YubiKey interface, you will need to install two optional dependencies:

  • GPG (any gpg client that provides command-line gpg functionality should do)
  • securesystemslib (pip install securesystemslib)

Demonstration and Use

Use of the command-line utility provides help functionality::

conda-content-trust --help

You should be able to run the demo after installing:

python3 demo.py

(Portions of the demo may require the optional dependencies above.)

Testing

Each set of tests is a module in the tests/ directory. These can all be run with:

pytest

Owner

  • Name: conda
  • Login: conda
  • Kind: organization

conda is system-level, binary package and environment manager running on all major operating systems and platforms.

GitHub Events

Total
  • Issues event: 4
  • Watch event: 1
  • Delete event: 43
  • Issue comment event: 19
  • Push event: 58
  • Pull request review event: 34
  • Pull request event: 98
  • Create event: 45
Last Year
  • Issues event: 4
  • Watch event: 1
  • Delete event: 43
  • Issue comment event: 19
  • Push event: 58
  • Pull request review event: 34
  • Pull request event: 98
  • Create event: 45

Committers

Last synced: about 1 year ago

All Time
  • Total Commits: 229
  • Total Committers: 11
  • Avg Commits per committer: 20.818
  • Development Distribution Score (DDS): 0.795
Past Year
  • Commits: 56
  • Committers: 4
  • Avg Commits per committer: 14.0
  • Development Distribution Score (DDS): 0.625
Top Committers
Name Email Commits
Conda Bot 1****t 47
Sebastien Awwad s****d@g****m 37
pre-commit-ci[bot] 6****] 34
Daniel Holth d****h@a****m 32
dependabot[bot] 4****] 23
Ken Odegard k****d@a****m 20
Jannis Leidel j****s@l****o 14
Bianca Henderson b****a@g****m 12
Daniel Bast 2****t 6
Mike Sarahan m****n@g****m 2
Cheng H. Lee c****e@a****m 2
Committer Domains (Top 20 + Academic)
anaconda.com: 3 leidel.info: 1

Issues and Pull Requests

Last synced: 10 months ago

All Time
  • Total issues: 12
  • Total pull requests: 284
  • Average time to close issues: 9 months
  • Average time to close pull requests: about 1 month
  • Total issue authors: 6
  • Total pull request authors: 9
  • Average comments per issue: 1.67
  • Average comments per pull request: 0.43
  • Merged pull requests: 182
  • Bot issues: 1
  • Bot pull requests: 174
Past Year
  • Issues: 1
  • Pull requests: 125
  • Average time to close issues: 9 days
  • Average time to close pull requests: 13 days
  • Issue authors: 1
  • Pull request authors: 3
  • Average comments per issue: 0.0
  • Average comments per pull request: 0.28
  • Merged pull requests: 73
  • Bot issues: 1
  • Bot pull requests: 105
View more stats
Top Authors
Issue Authors
  • kenodegard (4)
  • barabo (2)
  • adriendelsalle (2)
  • dholth (2)
  • westurner (1)
  • dependabot[bot] (1)
Pull Request Authors
  • dependabot[bot] (118)
  • conda-bot (63)
  • pre-commit-ci[bot] (56)
  • kenodegard (24)
  • jezdez (9)
  • dholth (6)
  • awwad (6)
  • beeankha (1)
  • dbast (1)
Top Labels
Issue Labels
locked (6) stale (6) stale::closed (6) source::anaconda (6) type::bug (3) backlog (2) type::task (2) type::feature (2) type::tech-debt (1) downstream::anaconda (1) pending::discussion (1) severity::2 (1) github_actions (1) dependencies (1) cla-signed (1) in-progress (1) stale::recovered (1)
Pull Request Labels
cla-signed (241) locked (107) dependencies (100) github_actions (100) in-progress (2) stale (2) stale::closed (2) source::anaconda (1) type::testing (1)

Packages

  • Total packages: 3
  • Total downloads:
    • pypi 96 last-month
  • Total docker downloads: 217,121,137
  • Total dependent packages: 3
    (may contain duplicates)
  • Total dependent repositories: 250
    (may contain duplicates)
  • Total versions: 5
  • Total maintainers: 1
pypi.org: conda-content-trust

Signing and verification tools for conda

  • Versions: 1
  • Dependent Packages: 0
  • Dependent Repositories: 162
  • Downloads: 96 Last month
  • Docker Downloads: 217,121,137
Rankings
Docker downloads count: 0.4%
Dependent repos count: 1.2%
Average: 9.2%
Dependent packages count: 10.1%
Forks count: 10.2%
Downloads: 13.2%
Stargazers count: 20.4%
Maintainers (1)
awwad
Last synced: 10 months ago
conda-forge.org: conda-content-trust
  • Versions: 1
  • Dependent Packages: 3
  • Dependent Repositories: 44
Rankings
Dependent repos count: 5.4%
Dependent packages count: 15.6%
Average: 31.7%
Forks count: 46.2%
Stargazers count: 59.7%
Last synced: 10 months ago
anaconda.org: conda-content-trust
  • Versions: 3
  • Dependent Packages: 0
  • Dependent Repositories: 44
Rankings
Dependent repos count: 25.5%
Average: 46.5%
Dependent packages count: 51.2%
Forks count: 52.7%
Stargazers count: 56.5%
Last synced: 10 months ago

Dependencies

.github/workflows/cla.yml actions
  • conda/actions/check-cla v22.9.0 composite
.github/workflows/issues.yml actions
  • actions-ecosystem/action-add-labels v1.1.0 composite
  • actions-ecosystem/action-remove-labels v1.3.0 composite
.github/workflows/labels.yml actions
  • EndBug/label-sync v2.3.0 composite
  • actions/checkout v3 composite
  • andstor/file-existence-action v1.0.1 composite
.github/workflows/lock.yml actions
  • dessant/lock-threads v2 composite
.github/workflows/project.yml actions
  • actions/add-to-project v0.3.0 composite
.github/workflows/stale.yml actions
  • actions/stale v4 composite
  • conda/actions/read-yaml v22.9.0 composite
.github/workflows/builds-review.yaml actions
  • actions/checkout v3 composite
  • actions/github-script v6 composite
  • conda/actions/canary-release v23.7.0 composite
.github/workflows/tests.yml actions
  • actions/cache v3 composite
  • actions/checkout v3 composite
  • actions/setup-python v4 composite
  • codecov/codecov-action v3 composite
  • conda-incubator/setup-miniconda v2 composite
  • conda/actions/canary-release v23.7.0 composite
pyproject.toml pypi
  • cryptography >=41
tests/requirements.txt pypi
  • conda >=22.11 test
  • conda-forge * test
  • cryptography >=41.0.0 test
  • pytest * test
  • pytest-benchmark * test
  • pytest-cov * test
  • setuptools_scm * test