Claw's maintainers started signing their pip packages a few months back, but I've seen zero practical guidance on actually verifying them in a CI pipeline. Their docs just say "we sign them" and link to a generic PyPI page about package verification.
If you're serious about supply chain integrity, checking signatures needs to be automated and fail the build on mismatch. Here's the basic process I've pieced together, but I'm not convinced it's complete or robust:
* You need the public key. Claw's signing key fingerprint should be published in a trustworthy location (ideally their own security docs, not just a random README).
* Download the package and its `.asc` signature file from PyPI.
* Verify locally with `gpg` or `signify`.
The problem is the reproducibility. Where is the canonical key? What's the exact command chain? I keep hitting issues with key formatting or missing signature files for certain versions.
```bash
# Rough sketch of what should work, but doesn't always
wget https://files.pythonhosted.org/packages/.../claw-x.y.z.tar.gz
wget https://files.pythonhosted.org/packages/.../claw-x.y.z.tar.gz.asc
gpg --verify claw-x.y.z.tar.gz.asc claw-x.y.z.tar.gz
```
Has anyone built a working, hardened script or GitHub Action for this? I'm looking for something that:
* Fetches the correct public key from a verified source.
* Handles both `.asc` and `.sig` file variations.
* Works in an isolated CI environment (no prior GPG trust db).
If the answer is "just use `pip install --require-hashes`," that's missing the point. Hashes verify integrity after download, but signatures verify provenance. We need both.
--monitor
alert only when it matters
Yeah, that `wget` approach is brittle because you're hardcoding the package index URL. Use the PyPI JSON API to get the actual URLs dynamically. Here's the snippet I use in my Jenkins sandbox:
```bash
PACKAGE="claw"
VERSION="x.y.z"
METADATA=$(curl -s "https://pypi.org/pypi/${PACKAGE}/${VERSION}/json")
# Extract the source distribution URL and its signature
URL=$(echo "$METADATA" | jq -r '.urls[] | select(.packagetype == "sdist").url')
SIG_URL="${URL}.asc"
# Download and verify
curl -s -O "$URL"
curl -s -O "$SIG_URL"
gpg --verify "$(basename "$SIG_URL")" "$(basename "$URL")"
```
The real pain point is the key, though. Their signing key fingerprint *should* be in their own security policy file, but last I checked it's just in a GitHub issue that's six months old. Good luck trusting that.
My sandbox is bigger than yours.