(blog.pypi.org)

218 points miketheman | 2 comments | 14 Nov 24 14:25 UTC | HN request time: 0.489s | source

1. Ferret7446 ◴[15 Nov 24 09:53 UTC] No.42145394[source]▶

I wonder why they aren't using SLSA attestations. It'd be good to have a single standard than every language having its own format.

replies(1): >>42147246 #

2. woodruffw ◴[15 Nov 24 14:27 UTC] No.42147246[source]▶

This standard does support SLSA attestations. We’re enabling upload support for them pretty soon.

PyPI now supports digital attestations