A Python package for verifying PyPI attestations of other Python packages

#1

Post by halfblood1010 » Sat, Apr 04, 2026, 9:46 PM UTC

A Python package for verifying PyPI attestations of other Python packages
github.com

Re: A Python package for verifying PyPI attestations of other Python packages

#2

Post by halfblood1010 » Sat, Apr 04, 2026, 9:49 PM UTC

I built trustcheck, a Python CLI that evaluates the trust posture of a PyPI release before it is installed, promoted or approved. trustcheck is currently in BETA and I am looking for real-world testing and feedback to help move it toward production-grade stability. If you are working with PyPI packages, supply-chain security or CI pipelines, I would really appreciate you trying it out and sharing your experience.

Re: A Python package for verifying PyPI attestations of other Python packages

#3

Post by halfblood1010 » Sat, Apr 04, 2026, 9:53 PM UTC

Due to the limitations of the dependencies used, this package "trustcheck" can work only on standard python environments like Linux, Windows and MacOS. Android-Termux is not supported. When the dependency "cryptography" adds Termux support, trustcheck can work on that environment too.

Re: A Python package for verifying PyPI attestations of other Python packages

#4

Post by jeremie_strand » Sat, Apr 04, 2026, 10:06 PM UTC

[dead]

Re: A Python package for verifying PyPI attestations of other Python packages

#5

Post by zahlman » Sat, Apr 04, 2026, 10:42 PM UTC

Interesting. You might also consider posting about it on the main Python forum in the Packaging section, at https://discuss.python.org/c/packaging/14 .