docs: add Prerequisites section to attestations (pypi#17164)

Signed-off-by: William Woodruff <william@trailofbits.com>
Marcelina14 · Nov 25, 2024 · fce17a5 · fce17a5
1 parent 1587fe2
commit fce17a5
Showing 1 changed file with 16 additions and 5 deletions.
diff --git a/docs/user/attestations/producing-attestations.md b/docs/user/attestations/producing-attestations.md
@@ -5,11 +5,21 @@
 PyPI allows attestations to be attached to individual *release files*
 (source and binary distributions within a release) at upload time.
 
-Attestations are currently only supported when uploading with
-[Trusted Publishing], and currently only with GitHub and GitLab-based
-Trusted Publishers. Support for other Trusted Publishers is planned. See
-[#17001](https://github.com/pypi/warehouse/issues/17001) for additional
-information.
+## Prerequisites
+
+Before uploading attestations to the index, please:
+
+* Review the [Linux Foundation Immutable Record notice], which applies to the
+  public transparency log.
+* Set up [Trusted Publishing] with a supported CI/CD provider. Supported
+  providers are listed below with instructions for each.
+
+    !!! note
+
+        Support for other Trusted Publishers is planned.
+        See #17001 for additional information.
+
+## Producing attestations
 
 === "GitHub Actions"
 
@@ -224,3 +234,4 @@ information.
 [legacy upload API documentation]: https://warehouse.pypa.io/api-reference/legacy.html#upload-api
 
 [GitLab Trusted Publishing]: /trusted-publishers/using-a-publisher/#gitlab-cicd
+[Linux Foundation Immutable Record notice]: https://lfprojects.org/policies/hosted-project-tools-immutable-records/