spiffe

library0.2.9pypypi✓ verified 89d ago

Python library for SPIFFE (Secure Production Identity Framework for Everyone) support, enabling workload identity in zero-trust architectures. Current version 0.2.9, released December 2024. Pre-release, active development.

security

pip install spiffe

github ↗homepage ↗

INSTALL

IMPORT

SIG · SPIFFE

spiffe

securitypythonv0.2.9

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SpiffeId

✓ from spiffe import SpiffeId

✗ from spiffe.core import SpiffeId

SpiffeId is in top-level package, not spiffe.core

X509Source

✓ from spiffe.workload_api.x509_source import X509Source

✗ from spiffe.x509_source import X509Source

Correct import from submodule

JwtSource

✓ from spiffe.workload_api.jwt_source import JwtSource

✗ from spiffe.jwt_source import JwtSource

Correct import from submodule

Fetch an X.509 SVID from a SPIRE Agent using the default Unix domain socket path.

import os from spiffe import SpiffeId from spiffe.workload_api.x509_source import X509Source # Create X509 source using default SPIRE agent socket path # Or set environment variable SPIFFE_ENDPOINT_SOCKET x509_source = X509Source() # Fetch X509 SVID svid = x509_source.fetch_x509_svid() print(f'SPIFFE ID: {svid.spiffe_id}') x509_source.stop()

Debug

Known issues

breakingAsyncX509Source and AsyncJwtSource APIs differ from synchronous versions. Use `async with` context managers or call `await source.start()` and `await source.stop()`.

fix

Use `async with AsyncX509Source() as source:` for proper lifecycle management.

affects: >=0.2.0

gotchaX509Source (synchronous) is not thread-safe. Do not share a single instance across threads.

fix

Create a new X509Source per thread or use threading locks.

affects: all

deprecatedThe function `spiffe.workload_api.x509_context.X509Context` is deprecated. Use `spiffe.workload_api.x509_source.X509Source` instead.

fix

Replace `X509Context` with `X509Source` and adjust method calls.

affects: <0.2.0

Errors

Common errors & fixes

ImportError: cannot import name 'SpiffeId' from 'spiffe'

Incorrect package installation or very old version (pre-0.2.0). SpiffeId was added in 0.2.0.

fix

Upgrade spiffe to >=0.2.0: `pip install --upgrade spiffe`

FileNotFoundError: [Errno 2] No such file or directory: '/tmp/spire-agent/public/api.sock'

Default socket path is /tmp/spire-agent/public/api.sock but your SPIRE Agent uses a different path or socket is missing.

fix

Set the environment variable `SPIFFE_ENDPOINT_SOCKET` to the correct socket path, e.g., `export SPIFFE_ENDPOINT_SOCKET=/run/spire/agent.sock`.

TypeError: __init__() got an unexpected keyword argument 'spiffe_id'

Using deprecated constructor signature. Newer versions changed the SpiffeId constructor parameter from 'spiffe_id' to 'trust_domain' and 'path'.

fix

Use `SpiffeId(trust_domain='example.org', path='/workload')` instead of `SpiffeId(spiffe_id='spiffe://example.org/workload')`.

grpc.RpcError: <_MultiThreadedRendezvous: StatusCode.UNAVAILABLE, ...>

Failed to connect to SPIRE Agent. Agent may be down or socket path is incorrect.

fix

Verify SPIRE Agent is running and the socket path is correct. Check `SPIFFE_ENDPOINT_SOCKET` environment variable.

Upgrade

Version history

0.2.9latest on PyPI · released May 11, 2026

Audit

Dependencies

cryptographyrequiredX.509 certificate handling

grpciorequiredgRPC communication with SPIRE Agent

Agent activity

23 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/HewlettPackard/py-spiffe ↗

homepagehttps://github.com/HewlettPackard/py-spiffe ↗