PyPI project pages now show provenance and security warnings
Original title: PyPI's redesigned project pages with clearer security signals are now live
The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.
PyPI completed interface updates that surface release provenance and package details. A new security tab shows whether files carry PyPI Publish or SLSA Build Provenance attestations. Warnings cover incomplete, inconsistent, changed, or lost provenance. A quarantine banner takes precedence over other warnings.
- Full provenance means every release file has an attestation.
- No provenance means the file origin cannot be cryptographically verified.
- Late files are marked with an orange warning icon.
- The design follows the OpenSSF Attestations Style Guide.
- 1.Check provenance warnings and release notes before installing.
- 2.Maintainers can use Trusted Publishing so publishers generate attestations.
- Products
- PyPI
- Organizations
- OpenSSFKabu Creative
From the original article
5 min read at blog.pypi.org
In July, we announced a series of planned updates to the PyPI user interface. Shaped by user research with members of the Python community , the updates aim to improve how we surface security signals and display package details. We're pleased to share that this work is now complete and live on PyPI .
By blog.pypi.org via ubernostrum · blog.pypi.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.