Attestations: A new generation of signatures on PyPI
Summary: Trail of Bits worked with PyPI on index-hosted digital attestations specified in PEP 740, which replace the disabled PGP signatures by binding a package's filename and digest to its publishing identity through Sigstore's keyless signing and the in-toto Attestation Framework. As of October 29, attestations are the default for anyone publishing via the PyPA GitHub action with Trusted Publishing, covering roughly 20,000 packages, while only 5% of the 360 most-downloaded packages have uploaded attestations so far.
What's compelling: PEP 740 defines no verification flow for installing clients like pip and uv, so downstream users still have to trust PyPI to serve attestations honestly - and with around two-thirds of the most-downloaded packages not updated since enablement, the ecosystem's most depended-on code remains largely unattested.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026