Release
PyPI makes release attestations easier to find with new security tab
Help Net Security · By Anamarija Pogorelec ·
The Brief
- PyPI added a Security tab to its project pages.
- The tab shows whether release files have digital attestations and where they came from.
- The change makes existing release provenance information easier to find.
Why it matters
Developers can check the origin of individual PyPI release files directly on project pages instead of digging through other tooling, which helps when vetting dependencies.
Who’s affected
- Python package maintainers
- Developers installing packages from PyPI
- #pypi
- #python
- #supply-chain
- #attestations
- #package-security
The Python Package Index (PyPI) has added a security tab to its project pages, giving developers a place to check where individual release files came from. How PyPI shows where release files came from The Security tab shows whether release files have digital attestations, which…
Timeline
PyPI added a Security tab to project pages showing release file attestations
Help Net Security
PyPI makes release attestations easier to find with new security tab