PyPI's redesigned project pages with clearer security signals are now live

In July, PyPI announced updates to its user interface aimed at improving security signals and displaying package details, based on user research with the Python community. These updates are now live. With the Python ecosystem's rapid growth, PyPI has become an attractive target for malicious actors. To combat this, the PyPI team has introduced several security features, including digital attestations, which provide a verifiable record of a release file's provenance.

However, these concepts were unfamiliar to many PyPI users, and the interface did not effectively communicate their meaning or importance.

To address this, PyPI partnered with Kabu Creative to implement recommendations from the OpenSSF Attestations Style Guide, resulting in clearer security signals in the PyPI UI. The new security tab provides a dedicated place to verify release file origins, displaying per-file attestations and release provenance states.

Provenance states can be one of two: either all files have attestations, or no files have attestations. If no provenance is present, it typically means the release files cannot be cryptographically verified and should be assessed using other trust signals like maintainer history, release patterns, and repository activity. Provenance warnings help identify when a file may not come from the project maintainers, indicating potential compromises or unauthorized changes.

The updated project detail page now includes a redesigned release files tab for easier navigation and viewing of provenance states, along with late file warnings for files uploaded after 14 days. The release history tab provides more details about each release, including file count, provenance state, and release status.