@yossarian can you force pip to require attestations during a pip install?

[risottobias@tech.lgbt]

@yossarian can you force pip to require attestations during a pip install?

[yossarian@infosec.exchange]

@risottobias not at the moment — attestation verification requires components that aren’t easy to integrate into pip directly, since pip has vendoring/pure python requirements. Our current plan is to build a verification plugin that’ll extend pip, and to work longer term on direct integration into pip

[risottobias@tech.lgbt]

@yossarian but then I can flag --verification=[required|default|off]

[yossarian@infosec.exchange]

@risottobias yes, an interface like that is roughly the goal!