Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attestations: A new generation of signatures on PyPI

blog.trailofbits.com | blog | #supply-chain | #pypi | #python | #sigstore | #pep-740 | #signing | #provenance

Summary

Trail of Bits partnered with PyPI on PEP 740 index-hosted attestations, improving on disabled PGP signatures via Sigstore keyless signing; Trusted Publishing users now get provenance by default.
Published
Collected

original ↗

Related coverage

  1. Securing the software supply chain with the SLSA framework (blog.trailofbits.com)
  2. Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting (about.gitlab.com)
  3. Ultralytics AI Library Hacked via GitHub for Cryptomining (wiz.io)
  4. State divergence enables unauthorized access (blog.trailofbits.com)
  5. Celebrating our 2025 open-source contributions (blog.trailofbits.com)
  6. Building cryptographic agility into Sigstore (blog.trailofbits.com)

back