You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
betterproto's handling of the Struct WKT is partially broken. I've tried to fix it, but round-tripping a JSON serialized message through a Struct is still impossible, which causes all kinds of problems for the (mostly in-toto) definitions that use Struct
Finally, the models and their APIs themselves aren't particularly Pythonic -- this is more of an issue with protobuf itself than betterproto, but results in development friction and impedance mismatches elsewhere that we have to paper over
As such, we should probably remove our dependency on betterproto in the medium term. There are a few blockers to doing this:
The Bundle, etc. models all come from protobuf-specs, which is currently built on top of betterproto for the Python bindings.
There are (probably) a few places we leak references to betterproto-generated models in Sigstore's public APIs
(1) is probably addressable either by re-modeling the relevant parts of protobuf-specs in pydantic, or by regenerating the Python bindings on top of the JSON Schema for protobuf-specs. (2) may require a major reversion.
Our dependency on
betterproto
is a source of a few issues:2.x
series, which is only in beta (currently2.0.0b6
). This is both non-ideal and is incompatible with some Python installers, most notablyuv
: https://github.com/astral-sh/uv/blob/main/PIP_COMPATIBILITY.md#pre-release-compatibilitybetterproto
's handling of theStruct
WKT is partially broken. I've tried to fix it, but round-tripping a JSON serialized message through aStruct
is still impossible, which causes all kinds of problems for the (mostly in-toto) definitions that useStruct
betterproto
, but results in development friction and impedance mismatches elsewhere that we have to paper overAs such, we should probably remove our dependency on
betterproto
in the medium term. There are a few blockers to doing this:Bundle
, etc. models all come fromprotobuf-specs
, which is currently built on top ofbetterproto
for the Python bindings.betterproto
-generated models in Sigstore's public APIs(1) is probably addressable either by re-modeling the relevant parts of
protobuf-specs
in pydantic, or by regenerating the Python bindings on top of the JSON Schema forprotobuf-specs
. (2) may require a major reversion.CC @DarkaMaul since he noticed this 🙂
The text was updated successfully, but these errors were encountered: