{"id":46429,"library":"spiffe","title":"PySPIFFE","description":"Python library for SPIFFE (Secure Production Identity Framework for Everyone) support, enabling workload identity in zero-trust architectures. Current version 0.2.9, released December 2024. Pre-release, active development.","status":"active","version":"0.2.9","language":"python","source_language":"en","source_url":"https://github.com/HewlettPackard/py-spiffe","tags":["spiffe","spire","workload-identity","zero-trust","x509","jwt"],"install":[{"cmd":"pip install spiffe","lang":"bash","label":"PyPI"}],"dependencies":[{"reason":"X.509 certificate handling","package":"cryptography","optional":false},{"reason":"gRPC communication with SPIRE Agent","package":"grpcio","optional":false}],"imports":[{"note":"SpiffeId is in top-level package, not spiffe.core","wrong":"from spiffe.core import SpiffeId","symbol":"SpiffeId","correct":"from spiffe import SpiffeId"},{"note":"Correct import from submodule","wrong":"from spiffe.x509_source import X509Source","symbol":"X509Source","correct":"from spiffe.workload_api.x509_source import X509Source"},{"note":"Correct import from submodule","wrong":"from spiffe.jwt_source import JwtSource","symbol":"JwtSource","correct":"from spiffe.workload_api.jwt_source import JwtSource"}],"quickstart":{"code":"import os\nfrom spiffe import SpiffeId\nfrom spiffe.workload_api.x509_source import X509Source\n\n# Create X509 source using default SPIRE agent socket path\n# Or set environment variable SPIFFE_ENDPOINT_SOCKET\nx509_source = X509Source()\n\n# Fetch X509 SVID\nsvid = x509_source.fetch_x509_svid()\nprint(f'SPIFFE ID: {svid.spiffe_id}')\n\nx509_source.stop()","lang":"python","description":"Fetch an X.509 SVID from a SPIRE Agent using the default Unix domain socket path."},"warnings":[{"fix":"Use `async with AsyncX509Source() as source:` for proper lifecycle management.","message":"AsyncX509Source and AsyncJwtSource APIs differ from synchronous versions. Use `async with` context managers or call `await source.start()` and `await source.stop()`.","severity":"breaking","affected_versions":">=0.2.0"},{"fix":"Create a new X509Source per thread or use threading locks.","message":"X509Source (synchronous) is not thread-safe. Do not share a single instance across threads.","severity":"gotcha","affected_versions":"all"},{"fix":"Replace `X509Context` with `X509Source` and adjust method calls.","message":"The function `spiffe.workload_api.x509_context.X509Context` is deprecated. Use `spiffe.workload_api.x509_source.X509Source` instead.","severity":"deprecated","affected_versions":"<0.2.0"}],"env_vars":null,"search_vec":"'0.2.9':23 '2024':26 'activ':30 'architectur':20 'current':21 'decemb':25 'develop':31 'enabl':13 'everyon':11 'framework':9 'ident':8,15,36 'jwt':41 'librari':3 'pre':28 'pre-releas':27 'product':7 'pyspiff':1 'python':2 'releas':24,29 'secur':6 'spiff':5,32 'spire':33 'support':12 'trust':19,39 'version':22 'workload':14,35 'workload-ident':34 'x509':40 'zero':18,38 'zero-trust':17,37","created_at":"2026-06-07T12:59:53.437959+00:00","updated_at":"2026-06-07T12:59:53.437959+00:00","problems":[{"fix":"Upgrade spiffe to >=0.2.0: `pip install --upgrade spiffe`","cause":"Incorrect package installation or very old version (pre-0.2.0). SpiffeId was added in 0.2.0.","error":"ImportError: cannot import name 'SpiffeId' from 'spiffe'"},{"fix":"Set the environment variable `SPIFFE_ENDPOINT_SOCKET` to the correct socket path, e.g., `export SPIFFE_ENDPOINT_SOCKET=/run/spire/agent.sock`.","cause":"Default socket path is /tmp/spire-agent/public/api.sock but your SPIRE Agent uses a different path or socket is missing.","error":"FileNotFoundError: [Errno 2] No such file or directory: '/tmp/spire-agent/public/api.sock'"},{"fix":"Use `SpiffeId(trust_domain='example.org', path='/workload')` instead of `SpiffeId(spiffe_id='spiffe://example.org/workload')`.","cause":"Using deprecated constructor signature. Newer versions changed the SpiffeId constructor parameter from 'spiffe_id' to 'trust_domain' and 'path'.","error":"TypeError: __init__() got an unexpected keyword argument 'spiffe_id'"},{"fix":"Verify SPIRE Agent is running and the socket path is correct. Check `SPIFFE_ENDPOINT_SOCKET` environment variable.","cause":"Failed to connect to SPIRE Agent. Agent may be down or socket path is incorrect.","error":"grpc.RpcError: <_MultiThreadedRendezvous: StatusCode.UNAVAILABLE, ...>"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/HewlettPackard/py-spiffe","github":"https://github.com/HewlettPackard/py-spiffe","docs":null,"changelog":null,"pypi":null,"npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-29","last_verified":"2026-06-29","next_check":"2026-07-29","install_tag":null}}