skills.rest
oborchers
oborchersCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-supply-chain

Secure Python package supply chains with trusted publishing, Sigstore attestations, and pip-audit scanning.

28|3|Updated Feb 22, 2026
Search Tags:#security#python#pypi#supply chain#vulnerability scanning#oidc#sigstore
One-click install
npx skills add https://github.com/oborchers/fractional-cto --skill security-supply-chain
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-supply-chain
Source: https://github.com/oborchers/fractional-cto/tree/main/python-package/skills/security-supply-chain
Command: npx skills add https://github.com/oborchers/fractional-cto --skill security-supply-chain

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical and growing threat of supply chain attacks on open-source software by providing a comprehensive framework for securing Python packages.

Core Features & Use Cases

  • Trusted Publishing: Replaces long-lived API tokens with secure OIDC tokens for PyPI publishing.
  • Vulnerability Scanning: Integrates pip-audit to continuously scan dependencies for known vulnerabilities.
  • Supply Chain Hardening: Implements best practices like Sigstore attestations, SLSA compliance, and CI permission hardening.
  • Use Case: Ensure your critical Python library is protected against malicious takeovers and vulnerable dependencies by implementing all recommended security measures.

Quick Start

Implement trusted publishing for your Python package on PyPI.

Frequently Asked Questions about security-supply-chain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure my Python package supply chain against malicious takeovers?▼

To secure your Python package supply chain, implement trusted publishing with OIDC tokens, scan dependencies for vulnerabilities using pip-audit, and apply SLSA compliance and Sigstore attestations to ensure build integrity.

How does trusted publishing replace PyPI API tokens for secure publishing?▼

Trusted publishing replaces long-lived PyPI API tokens with short-lived OIDC tokens generated by your CI/CD provider. This prevents credential leakage and ensures that only authenticated workflows can publish packages.

What is the best way to scan Python dependencies for known vulnerabilities?▼

The best way to scan Python dependencies for vulnerabilities is integrating pip-audit into your CI/CD pipeline. This continuously checks your project's dependencies against known vulnerability databases.

How do I implement Sigstore attestations for my Python packages?▼

Implementing Sigstore attestations involves signing your Python packages during the build process to create cryptographic proofs of provenance. This aligns with PEP 740 and SLSA compliance frameworks to verify build integrity.

Can I use this supply chain security framework for my existing Python CI/CD pipelines?▼

Yes, you can apply this framework to existing Python CI/CD pipelines by hardening CI permissions, replacing legacy API tokens with OIDC trusted publishing, and integrating pip-audit for continuous vulnerability scanning.

Why do I need SLSA compliance for my Python packages?▼

You need SLSA compliance to guarantee the integrity of your Python package build process. It provides a framework to secure against build process compromises and vulnerable dependencies by enforcing provenance and attestation.

Related Skills

Explore More Software Engineering Skills→
stevenke1981stevenke1981
1

py-packaging

Manage Python packaging, dependency resolution, and artifact distribution with pyproject.toml.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

hardened-release-workflow

Automate hardened release workflows with signed artifacts and SLSA provenance.

Official
Advanced
diarworlddiarworld
6

ai-factory.ci

Generate and enhance CI/CD pipelines for GitHub Actions and GitLab CI.

Community
Advanced
cornmanwtfcornmanwtf

supply-chain-security

Generate SBOMs, verify third-party dependencies, and sign build artifacts.

Community
Advanced