![Maven Central Adds Sigstore Signature Validation](https://cdn.sanity.io/images/cgdhsj6q/production/7da3bc8a946cfb5df15d7fcf49767faedc72b483-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Historically, the snowflake
package on PyPI was an unrelated package owned
by an independent developer not affiliated with
Snowflake. After friendly discussion in
2023, it was agreed to transfer the PyPI snowflake
package name to
Snowflake.
In order to provide a more manageable transition, Snowflake has agreed to
maintain some backward compatibility with the old snowflake
package, now
renamed to snowflake-uuid. For a
period of one year, existing users of the old package will be able to:
import snowflake
and call snowflake.snowflake()
to return the contents
of /etc/snowflake
as a string, if it exists. No validation of the value
is performed. If /etc/snowflake
doesn't exist, a FileNotFoundError
will
be raised. snowflake.snowflake()
takes a single string argument which
names an alternative path to read from, and this is supported in the legacy
API.snowflake.make_snowflake()
will always raise a NotImplementedError
and
point users to the new snowflake-uuid
package.It is highly recommended that all consumers of the old snowflake
package
change their dependency to snowflake-uuid
as soon as possible.
FAQs
You should switch to the snowflake-uuid package
We found that snowflake._legacy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.