{"id":22369,"library":"sigstore-protobuf-specs","title":"sigstore-protobuf-specs","description":"A library for serializing and deserializing Sigstore messages (e.g., Bundle, DSSE, Envelope). Published as a Python package at version 0.5.1, maintained by the Sigstore project. Requires Python >=3.8. Release cadence is irregular, tied to upstream protobuf spec changes.","status":"active","version":"0.5.1","language":"python","source_language":"en","source_url":"https://github.com/sigstore/protobuf-specs","tags":["sigstore","protobuf","signing","verification","supply-chain-security"],"install":[{"cmd":"pip install sigstore-protobuf-specs","lang":"bash","label":"Install from PyPI"}],"dependencies":[{"reason":"Runtime dependency for protobuf message types.","package":"protobuf","optional":false}],"imports":[{"note":"Corrent path includes dev.sigstore.bundle.v1; wrong omits versioned subpackage.","wrong":"from sigstore_protobuf_specs.bundle import Bundle","symbol":"Bundle","correct":"from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle"},{"note":"Same versioned path issue; DSSE Envelope is under dev.sigstore.dsse.","wrong":"from sigstore_protobuf_specs.dsse import Envelope","symbol":"DSSEEnvelope","correct":"from sigstore_protobuf_specs.dev.sigstore.dsse import Envelope"},{"note":"Common types also under versioned v1 subpackage.","wrong":null,"symbol":"HashAlgorithm","correct":"from sigstore_protobuf_specs.dev.sigstore.common.v1 import HashAlgorithm"}],"quickstart":{"code":"from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle\n\n# Create an empty bundle\nbundle = Bundle()\nprint(bundle)\n","lang":"python","description":"Creates an empty Sigstore Bundle message using the official protobuf generated class."},"warnings":[{"fix":"Update imports to include 'dev' and version subpackage, e.g., 'from sigstore_protobuf_specs.dev.sigstore.bundle.v1 import Bundle'.","message":"Import paths changed in version 0.3.0: all protobuf messages are now under 'sigstore_protobuf_specs.dev.sigstore.*' with versioned subpackages (e.g., v1).","severity":"breaking","affected_versions":">=0.3.0"},{"fix":"For signing/verification, use the 'sigstore' package. This package is for low-level protobuf object manipulation.","message":"The package only provides protobuf message classes (serialization/deserialization). It does NOT include Sigstore verification or signing logic. Users often mistakenly import this for operational tasks.","severity":"gotcha","affected_versions":"all"},{"fix":"Use the full path with 'dev.sigstore....'.","message":"Direct import from 'sigstore_protobuf_specs.sigstore.*' (without 'dev') was deprecated in 0.3.0 and removed in 0.4.0.","severity":"deprecated","affected_versions":">=0.4.0"}],"env_vars":null,"search_vec":"'0.5.1':24 '3.8':32 'bundl':14 'cadenc':34 'chain':49 'chang':42 'deseri':10 'dsse':15 'e.g':13 'envelop':16 'irregular':36 'librari':6 'maintain':25 'messag':12 'packag':21 'project':29 'protobuf':3,40,44 'publish':17 'python':20,31 'releas':33 'requir':30 'secur':50 'serial':8 'sign':45 'sigstor':2,11,28,43 'sigstore-protobuf-spec':1 'spec':4,41 'suppli':48 'supply-chain-secur':47 'tie':37 'upstream':39 'verif':46 'version':23","created_at":"2026-04-27T17:04:49.251044+00:00","updated_at":"2026-04-27T17:04:49.251044+00:00","problems":{"verify_error":"× No solution found when resolving dependencies:\n  ╰─▶ Because there is no version of betterproto==2.0.0b5 and\n      sigstore-protobuf-specs<=0.2.1 depends on betterproto==2.0.0b5, we can\n      conclude that sigstore-protobuf-specs<=0.2.1 cannot be used.\n      And because only the following versions"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"0.5.1","cli_name":"","cli_version":null,"type":"library","homepage":"https://pypi.org/project/sigstore-protobuf-specs/","github":"https://github.com/sigstore/protobuf-specs","docs":null,"changelog":null,"pypi":"https://pypi.org/project/sigstore-protobuf-specs/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["serialization","auth-security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"install_fail","verified_at":"2026-06-28","last_verified":"2026-06-28","next_check":"2026-07-06","install_tag":null}}