PyPI project pages now show provenance and security warnings
The security tab shows per-file attestations and flags incomplete, inconsistent, changed, or lost provenance before install.
Stories per day · 30 days
Relatedattestations2in-toto1pypi1python1sigstore1software-supply-chain1supply-chain1trusted-publishing1witness1
4 stories, newest first · one card per story
Stories tagged #slsa
Witness records and checks how software was built before release
TestifySec donated the CLI to CNCF’s in-toto project; it signs build attestations and fails CI when policy checks do not pass.
1
12 Best Software Supply Chain Security Tools Compared (2026): Features & Pricing
A 2026 buyer's guide compares 12 software supply-chain security tools by attack surface, features, and pricing.
10
What It Took to Reach 1 Billion Build Manifests
Chainguard doubled container build manifests to over 1 billion in six months, powered by Factory 2.0's agentic self-correcting rebuild system.
2