From Pypi · · 1m 30s
PyPI's Security Signals Now Live
PyPI's redesigned project pages with clearer security signals are now live for better package safety.
In brief
PyPI's redesigned project pages with clearer security signals are now live for better package safety. PyPI launched updated security features to help users verify package provenance and reduce security risks. Originally reported by Pypi.
New Security Tab
PyPI introduced a dedicated security tab to display release provenance states and per-file attestations.
Provenance States
PyPI calculates release states as Full Provenance, No Provenance, or Incomplete Provenance with specific warnings.
Full Provenance
Full Provenance means 100% of release files have attestations, including PyPI Publish and SLSA Build Provenance.
No Provenance
No Provenance indicates no files have attestations, typical for older releases without Trusted Publishing.
Incomplete Provenance
Incomplete Provenance shows some files have attestations while others do not, requiring caution before installation.
Inconsistent Provenance
Inconsistent Provenance means files originate from different build systems or repositories within the same release.
Change of Provenance
Change of Provenance indicates a release file originated from a different repository than a previous release.
Loss of Provenance
Loss of Provenance means a project stopped generating attestations after previously having full provenance.
Redesigned Project Page
Project detail pages now show provenance warnings at the top with status banners for yanked releases and pre-releases.
Release History Updates
Release history tabs now show file counts, provenance states, and release statuses like quarantined or pre-release.
Getting Help
PyPI extended user documentation to guide users on assessing package security and reporting issues.
The takeaway
PyPI launched updated security features to help users verify package provenance and reduce security risks.
