Repository navigation
Publisher signature or attestation for the exact Windows wheel, opencv-python 4.14.0.94 #1277
Description
Hello opencv-python maintainers,
We are preparing a reproducible offline Python environment and need to locate
publisher-authenticated evidence for this existing, unmodified wheel:
We already established byte-for-byte equality between this PyPI wheel and the
wheel inside the official CI artifact. We retain that evidence separately from
publisher signature verification.
Could you point us to an existing signature/attestation bundle and the official
publisher verification policy for this exact wheel? We need the original signed
statement or detached signature, its certificate/public verification material,
and the required transparency or timestamp evidence. The policy should identify
the authorized public key or signer identity, issuer and predicate, as applicable,
through an official source independent of the candidate bundle itself.
Our dated public observations returned HTTP 404 for this wheel's PyPI provenance
endpoint and for the repository's GitHub attestation queries on the wheel and CI
container digests. The legacy Rekor index returned no UUIDs for those two digests.
We recognize that these results are incomplete discovery observations and do
not establish that no signature exists elsewhere.
If there is no existing proof, please let us know. If the project can issue a
new authorized publisher endorsement of the same bytes, we can assess it in a
new review while retaining its actual issue time and scope. We would not present
a later endorsement as proof that the original historical build/publication was
signed when it occurred. We are not asking for a wheel rebuild or replacement.
Only public verification material is needed; please do not provide any private
key, credential, password or access token. A pointer to the appropriate official
policy or existing artifact is sufficient for the next review.
Thank you.
Activity
luciorodrigues-tec commentedon Oct 27, 2026
Hello maintainers,
Following up on the request above: could you please confirm whether an official publisher signature or attestation is available for this exact wheel?
opencv_python-4.14.0.94-cp37-abi3-win_amd64.whlIf available, a link to the verification material and the official verification policy would be very helpful.
If no such proof is published, a brief confirmation would also help us document the limitation and assess our next steps.
Thank you for your time.
luciorodrigues-tec commentedon Oct 28, 2026
Hello OpenCV-Python maintainers,
I would like to kindly follow up on this request.
We are continuing the security and reproducibility validation of an isolated, offline Python environment using the exact, unmodified Windows wheel:
opencv_python-4.14.0.94-cp37-abi3-win_amd64.whlace53616cdffc9643e17e075397b493e607c427d388c7508798ef7ad2ed577ccWe have already established byte-for-byte equality with the official Windows CI artifact. However, we understand that binary equality alone does not constitute publisher-authenticated signature or provenance verification.
Could you please clarify whether:
A link to the applicable verification policy, authorized signer identity, existing attestation, or appropriate maintainer contact would be greatly appreciated.
We are not requesting a rebuild, replacement wheel, private key, or credential. Any newly issued endorsement would be assessed according to its actual issuance date and scope, without treating it as historical signing evidence.
Thank you for your time and for maintaining OpenCV-Python.