PyPI adds security tab for release attestations
Original title: PyPI makes release attestations easier to find with new security tab
Developers can review digital attestations and provenance status for every release file on project pages.
PyPI has added a Security tab to project pages that displays whether release files carry digital attestations. Full provenance requires every file to have at least one attestation identifying the Trusted Publisher or SLSA build details. Warnings appear for incomplete provenance, differing workflows across versions, or late uploads after the July 2026 policy change. Older releases commonly lack attestations and are not considered malicious.
Unconfirmed: Not applicable
- Full provenance means every file carries at least one attestation
- Warnings flag releases with files from different repositories or build systems
- Late uploads are refused after the policy change
- Vendors
- PyPI
From the original article
2 min read at helpnetsecurity.com
The Python Package Index (PyPI) has added a security tab to its project pages, giving developers a place to check where individual release files came from. How PyPI shows where release files came from The Security tab shows whether release files have digital attestations, which provide verifiable information about how a file was published or built.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.