· python
PyPI adds security tab to project pages for release attestation verification
Developers can now see exactly where individual release files originated thanks to a new security tab implemented on the Python Package Index (PyPI) project pages.
This new feature provides a dedicated location for users to verify the origins of published artifacts. The Security tab reveals whether the release files possess digital attestations, which furnish verifiable details concerning the process by which a file was constructed or distributed. Achieving complete provenance for a release requires that every single file within it carries a minimum of one such attestation. Specifically, a PyPI Publish attestation serves to identify the release's origin. This update, which simplifies the location of release attestations, was initially shared on Help Net Security.
Why it matters
This feature provides developers with a more direct way to verify the integrity of the packages they consume. Verifiable attestations help mitigate supply chain risks associated with software dependencies. Developers should now use this tab when assessing the trustworthiness of a project.
