Tag
PEP 740
Safeguard articles tagged "PEP 740" — guides, analysis, and best practices for software supply chain and application security.
2 articles
Open Source Security
How to Verify PyPI Attestations (PEP 740), and Which Top Packages Have Them
PyPI has accepted signed attestations since November 2024, but pip doesn't check them. How to verify one, how to catch a change of publisher in CI, and which of the top 1,000 packages attest today.
Oct 18, 202610 min read
Open Source Security
PyPI Attestation Requirements: A Roadmap Read
PEP 740 brings Sigstore-style attestations to PyPI. A close read of the roadmap, what's actually shipped, and what it means for consumers and publishers over the next 12 months.
Apr 1, 20267 min read
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.