Supply chain

A library that handles client private keys deserves scrutiny of how it is built and shipped. This page describes how releases are produced, so you can decide what to trust.

How a release is made

  • Published exclusively from GitHub Actions, from a tagged commit in the repository, via PyPI Trusted Publishing (OIDC). No long-lived PyPI tokens exist, so there is no publishing credential to steal.

  • PEP 740 digital attestations are generated for every artifact. Provenance is shown per file at pypi.org/project/httpx-pki.

  • The tag is verified against the code. The workflow checks that the release tag matches the package’s __version__ before building, so every release is auditable to exactly one commit.

  • All GitHub Actions are pinned to full commit SHAs, not tags. Tags are mutable and have been repointed at malicious commits in real supply-chain attacks. Dependabot keeps the pins current.

Runtime dependencies

The footprint is deliberately small:

Package

Why

httpx2

The HTTP client being extended

cryptography

Parsing and decrypting certificate material

truststore

The OS trust store behind verify=True

certifi

The bundle behind verify="certifi"

There are no optional runtime dependencies. See Install.

What you should do

Install with a lockfile that records hashes — as you would for any security-sensitive dependency:

$ uv lock
$ uv sync --locked

$ poetry lock
$ poetry install

$ pip-compile --generate-hashes
$ pip install --require-hashes -r requirements.txt

To verify a release yourself, check the attestations on the PyPI file listing against the tagged commit in the repository.

Next steps