PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attestations: A new generation of signatures on PyPI

blog.trailofbits.com | blog | #supply-chain | #pypi | #python | #sigstore | #pep-740 | #signing | #provenance
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits partnered with PyPI on PEP 740 index-hosted attestations, improving on disabled PGP signatures via Sigstore keyless signing; Trusted Publishing users now get provenance by default.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Securing the software supply chain with the SLSA framework
An overview of the SLSA framework's Build Levels 1-3, signed build provenance from CI/CD platforms, PEP 740 bringing SLSA provenance to PyPI, and how consumers can verify artifact origins.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
Celebrating our 2025 open-source contributions
Trail of Bits engineers merged 375+ pull requests into 90+ open-source projects in 2025, including Sigstore rekor-monitor, Rust compiler/Clippy, pyca/cryptography, hevm, PyPI Warehouse, and pwndbg.
blog · blog.trailofbits.com
Building cryptographic agility into Sigstore
Trail of Bits and Sigstore added cryptographic agility to software signing: a centralized algorithm registry, configurable restrictions in Rekor/Fulcio, Cosign support, and post-quantum LMS/ML-DSA.
Back