Skip to content
NewA calmer, faster ZeroHour
StoryToolsinfo

PyPI adds Security tab for release attestations and provenance

2 sources · 2 articlesFirst reported Updated ()1 · 1 read
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PyPI project pages now show per-file attestations and warn when release provenance is incomplete, inconsistent, changed, or lost.

PyPI has launched a Security tab on project pages so developers can see whether release files carry digital attestations before install. Full provenance requires every file to have at least one attestation identifying a Trusted Publisher or SLSA build details. Warnings cover incomplete, inconsistent, changed, or lost provenance; older releases that commonly lack attestations are not treated as malicious. Help Net Security says late uploads are refused after a July 2026 policy change; Lobsters says late files get an orange warning icon. A quarantine banner takes precedence over other warnings, and the design follows the OpenSSF Attestations Style Guide.

Key facts
  • Full provenance requires every release file to carry at least one attestation.
  • Attestations identify a Trusted Publisher or SLSA build provenance.
  • Warnings flag incomplete, inconsistent, changed, or lost provenance.
  • Older releases often lack attestations and are not treated as malicious.
  • A quarantine banner takes precedence over other provenance warnings.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 9, 2026PyPI Security tab and redesigned project pages go live · Lobsters

What each outlet adds

beyond the shared facts
  • Help Net SecurityJuly 2026 late-upload policy; older unattested releases not malicious.
  • LobstersQuarantine banner precedence, orange late-file icon, OpenSSF style guide.
Vendors
PyPI
Products
PyPI
Organizations
OpenSSFKabu Creative

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Help Net SecurityFirst report

    PyPI adds security tab for release attestations

    Developers can review digital attestations and provenance status for every release file on project pages.

  2. · 1d ago Lobsters · security

    PyPI project pages now show provenance and security warnings

    The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.