Metadata-Version: 2.4
Name: gcp-attest
Version: 0.1.0
Summary: Digital Attestations and Trusted Publishing via Google Cloud IAM
Project-URL: Source, https://codeberg.org/kytta/gcp-attest
Author-email: Nikita Karamov <me@kytta.dev>
License-Expression: ISC
License-File: LICENSE
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Software Development
Requires-Python: >=3.9
Requires-Dist: google-auth[requests]>=2.16.1
Description-Content-Type: text/markdown

# gcp-attest

Produce Digital Attestations and use PyPI Trusted Publishing using Google Cloud service accounts.

## Why

PyPI encourages Trusted Publishing, but their supported platforms do not include Codeberg. This is understandable: Supporting a new platform means trusting it, and for a long time neither of Codeberg's CI options even had an option to issue OIDC tokens.

PyPI trusts Google's OIDC, though. All OIDC tokens issued by Google Cloud IAM can be exchanged against valid PyPI publishing tokens. The same applies to Sigstore and digital attestations.

Google Cloud OIDC tokens usually represent a service account.  There are multiple ways to "log in" as said account to issue tokens:

1. Inside a Google Cloud workflow. This is the expected way and already supported by [di/id][id] and [pypi-attestations].
2. Using a long-lived credentials key file.
3. Using [Workload Identity Federation](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-providers)

The last one is interesting, as it allows us to exchange OIDC tokens from any valid identity provider for Google Cloud tokens. This way, Google Cloud acts like a proxy between PyPI and not (yet) supported OIDC providers.

This project aims to simplify publishing process by offering APIs to create attestations and exchange tokens.

## Licence

© 2026 [Nikita Karamov]\
Licensed under the [ISC License][ISC]

[id]: https://github.com/di/id
[ISC]: https://spdx.org/licenses/ISC.html
[Nikita Karamov]: https://www.kytta.dev/
[pypi-attestations]: https://github.com/pypi/pypi-attestations
