lock-attest
Checks every file pinned in a Python lockfile for a PyPI attestation, verifies it, and checks it was signed by the repository the project names. Anything not verified fails closed.
- Year
- 2026
- Kind
- Security · Python
- Status
- Shipped
A Python lockfile pins files by hash. lock-attest asks three questions of each one: does PyPI hold a PEP 740 attestation for exactly this file, does it verify, and was it signed from the repository the project itself names. Each file gets one of four states. Anything not positively verified fails closed, and "PyPI says there is none" is kept apart from "we could not find out".
A coverage study checks 41 releases from the Python AI/ML stack, pinned on 2026-09-26. 12 are attested and 25 have no provenance at all. Three are identity mismatches, and none is an attack: those projects sign from a separate release repository of the same owner. A mutation script switches off 25 safeguards one at a time, and each one turns the test suite red.
Attested does not mean safe: a compromised workflow in the right repository still produces an attested file. Unattested does not mean compromised either; most of PyPI predates PEP 740. Two releases uploaded with a stolen token in March 2026 are gone from PyPI, and the releases before them were unattested too, so provenance alone would not have singled them out.
