PyPI adds Security tab to show release file attestations and provenance status
The Python Package Index (PyPI) has added a Security tab to project pages that shows whether each release file carries a digital attestation, so developers can check where a package came from before installing it. A release has full provenance when every file is attested and no provenance when none is. The article notes that missing attestations are common for older releases and for projects that have not configured Trusted Publishing, and that they do not by themselves mean a package is malicious. PyPI now warns when only some files in a release are attested, when files in one release come from different repositories or build systems, or when a project that previously published attestations stops doing so.
Detalhes técnicos
- A PyPI Publish attestation identifies the Trusted Publisher that uploaded the file.
- A SLSA Build Provenance attestation links the file to its source commit, build platform and build instructions.
- Users can review attestation details in the tab or open the linked transparency log.
- The redesigned project page shows provenance warnings at the top, next to yanked, archived and pre-release notices. Quarantined projects or releases show only the quarantine banner.
- The Release Files tab flags files uploaded more than 14 days after a release that predates PyPI's July 2026 policy change. Since that change, PyPI has refused late uploads.
- The Release History tab shows file count, provenance status and release status for each version.
Linha do tempo
-
PyPI adds Security tab to show release file attestations and provenance status
ler a análise desta fonte ocultar
The Python Package Index (PyPI) has added a Security tab to project pages that shows whether each release file carries a digital attestation, so developers can check where a package came from before installing it. A release has full provenance when every file is attested and no provenance when none is. The article notes that missing attestations are common for older releases and for projects that have not configured Trusted Publishing, and that they do not by themselves mean a package is malicious. PyPI now warns when only some files in a release are attested, when files in one release come from different repositories or build systems, or when a project that previously published attestations stops doing so.
Technical Details
- A PyPI Publish attestation identifies the Trusted Publisher that uploaded the file.
- A SLSA Build Provenance attestation links the file to its source commit, build platform and build instructions.
- Users can review attestation details in the tab or open the linked transparency log.
- The redesigned project page shows provenance warnings at the top, next to yanked, archived and pre-release notices. Quarantined projects or releases show only the quarantine banner.
- The Release Files tab flags files uploaded more than 14 days after a release that predates PyPI's July 2026 policy change. Since that change, PyPI has refused late uploads.
- The Release History tab shows file count, provenance status and release status for each version.