Security●●Solid
Beta Testing needed for my package Trustcheck
Catches supply-chain attacks by verifying cryptographic attestations before pip install.
Solve My Problem
halfblood1010
602mo ago
Back to browse
GitHub Repository
Verify PyPI package attestations and improve Python supply-chain security
90 starsPython
Beta Testing needed for my package Trustcheck
by halfblood1010·Apr 11, 2026·1 point·1 comment
AI Analysis
●●SolidSolve My ProblemNiche GemShip It
Consolidates sigstore attestation verification and vulnerability scans into one pre-install CLI check.
Strengths
- •Verifies cryptographic attestations and Trusted Publisher identity hints alongside standard vulnerability records.
- •Strict mode fails CI when verification signals are missing or drift detected.
- •Exposes structured JSON output for integration with existing security pipelines and dashboards.
Weaknesses
- •Relies on maintainers publishing attestations; most packages lack these cryptographic signals today.
- •No Windows binary provided, requires Python 3.10+ environment setup before running checks.
Category
Target Audience
Python developers, DevSecOps engineers
Similar To
pip-audit · sigstore · OSV-Scanner
Similar Projects
Security●Mid
AI Content Attestation & Verification w/ Revocable Signatures
Revocable AI signatures solve version drift, but 'no key management' contradicts security basics.
Bold BetShip It
lyfeninja
242mo ago
Developer Tools●●Solid
Pypistats – Real-time PyPI trends, AI insights and badges
Real-time PyPI trends with Claude AI summaries, but analytics dashboards exist (npm trends, libraries.io).
Solve My ProblemCrowd Pleaser
diverdale
213mo ago
Developer Tools●●●Banger
I built a PyPI watchdog that tests whether packages work
Tests PyPI packages across 6 Python environments with live pass-rate dashboard.
Dark HorseNiche Gem
contentist
101mo ago
Developer Tools●Mid
PythonICO – Simple SVG Badges for PyPI Stats (FastAPI)
nodei.co already does this for npm; this is the Python clone without differentiation.
Ship It
livrasand
304mo ago
Security●Mid
Package Proxy
Yet another package proxy when Sonatype, Verdaccio, and Cloudsmith already own this space.
Ship It
mslaviero
207d ago