---
id: 1443
title: "Attestations: A new generation of signatures on PyPI"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2024/11/14/attestations-a-new-generation-of-signatures-on-pypi/"
published_at: "2024-11-14 14:00"
tags: ["supply-chain", "pypi", "python", "sigstore", "pep-740", "signing", "provenance"]
phying_url: "https://phying.com/item/1443"
lang: en
---

# Attestations: A new generation of signatures on PyPI

## Summary

Trail of Bits partnered with PyPI on PEP 740 index-hosted attestations, improving on disabled PGP signatures via Sigstore keyless signing; Trusted Publishing users now get provenance by default.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2024-11-14 14:00
- **Original:** https://blog.trailofbits.com/2024/11/14/attestations-a-new-generation-of-signatures-on-pypi/
- **Phying News:** https://phying.com/item/1443