PYPI NOW SUPPORTS DIGITAL ATTESTATIONS

Summary from the TLDR InfoSec newsletter

In an effort to enhance supply chain security, PyPi has added the ability for package maintainers to publish digital attestations with their packages. Attestations provide an additional layer of security over digital signatures as they are tied to an identity, must be verifiable, and include a link to the upstream source. Attestations can be viewed via the new Identity API or using the web UI.