PEP 740 · SLSA · census of one install set

What the supply chain actually signs

Full dependency set of one working engine: attestation present, digest match, signature verify, then the separate question of SLSA build provenance. Expectations published first.

53.2%

MUST refuse rate · 50 of 94 distributions · 53.2% serve no attestation

Prior run 53.2% → this run 53.2%.

Package

Version

Verdict

Refuse limb

Receipt

annotated-types

0.8.0

refuse

provenance_published

json

anthropic

0.120.2

refuse

provenance_published

json

beautifulsoup4

4.15.0

refuse

provenance_published

json

bitarray

3.10.0

refuse

provenance_published

json

cffi

2.1.0

refuse

provenance_published

json

ckzg

2.1.8

refuse

provenance_published

json

distro

1.9.0

refuse

provenance_published

json

edgartools

5.44.1

refuse

provenance_published

json

eth-abi

5.2.0

refuse

provenance_published

json

eth-account

0.13.7

refuse

provenance_published

json

eth-hash

0.8.0

refuse

provenance_published

json

eth-keyfile

0.8.1

refuse

provenance_published

json

eth-keys

0.7.0

refuse

provenance_published

json

eth-rlp

2.2.0

refuse

provenance_published

json

eth-typing

6.0.0

refuse

provenance_published

json

eth-utils

6.0.0

refuse

provenance_published

json

h11

0.16.0

refuse

provenance_published

json

helixhash

refuse

index_resolves

json

hexbytes

1.3.1

refuse

provenance_published

json

httpcore

1.0.9

refuse

provenance_published

json

httpx

0.28.1

refuse

provenance_published

json

lxml

6.1.1

refuse

provenance_published

json

markdown-it-py

4.2.0

refuse

provenance_published

json

mdurl

0.1.2

refuse

provenance_published

json

nest-asyncio

1.6.0

refuse

provenance_published

json

parsimonious

0.10.0

refuse

provenance_published

json

pdfminer-six

20260107

refuse

provenance_published

json

pdfplumber

0.11.10

refuse

provenance_published

json

pyarrow

25.0.0

refuse

provenance_published

json

pycparser

3.0

refuse

provenance_published

json

pycryptodome

3.23.0

refuse

provenance_published

json

pydantic-core

2.46.4

refuse

provenance_published

json

pygments

2.20.0

refuse

provenance_published

json

python-dateutil

2.9.0.post0

refuse

provenance_published

json

pyunormalize

17.0.0

refuse

provenance_published

json

rank-bm25

0.2.2

refuse

provenance_published

json

regex

2026.7.19

refuse

provenance_published

json

requests-oauthlib

2.0.0

refuse

provenance_published

json

rich

15.0.0

refuse

provenance_published

json

rlp

4.1.0

refuse

provenance_published

json

scipy

1.17.1

refuse

provenance_published

json

six

1.17.0

refuse

provenance_published

json

sniffio

1.3.1

refuse

provenance_published

json

tabulate

0.10.0

refuse

provenance_published

json

textdistance

4.6.3

refuse

provenance_published

json

truststore

0.10.4

refuse

provenance_published

json

types-requests

2.33.0.20260712

refuse

provenance_published

json

unidecode

1.4.0

refuse

provenance_published

json

web3

7.16.0

refuse

provenance_published

json

witnessfield

refuse

index_resolves

json

aiofiles

25.1.0

admit

predicate_is_slsa_build_provenance

json

aiohappyeyeballs

2.7.1

admit

predicate_is_slsa_build_provenance

json

aiohttp

3.14.3

admit

predicate_is_slsa_build_provenance

json

aiosignal

1.4.0

admit

predicate_is_slsa_build_provenance

json

anyio

4.14.2

admit

predicate_is_slsa_build_provenance

json

attrs

26.1.0

admit

predicate_is_slsa_build_provenance

json

certifi

2026.7.22

admit

predicate_is_slsa_build_provenance

json

charset-normalizer

3.4.9

admit

predicate_is_slsa_build_provenance

json

cryptography

50.0.0

admit

predicate_is_slsa_build_provenance

json

cytoolz

1.1.0

admit

predicate_is_slsa_build_provenance

json

docstring-parser

0.18.0

admit

predicate_is_slsa_build_provenance

json

filelock

3.32.2

admit

signer_matches_declared_source

json

frozenlist

1.8.0

admit

predicate_is_slsa_build_provenance

json

httpxthrottlecache

0.3.5

admit

predicate_is_slsa_build_provenance

json

humanize

4.16.0

admit

predicate_is_slsa_build_provenance

json

idna

3.18

admit

predicate_is_slsa_build_provenance

json

jinja2

3.1.6

admit

predicate_is_slsa_build_provenance

json

jiter

0.16.0

admit

predicate_is_slsa_build_provenance

json

markupsafe

3.0.3

admit

predicate_is_slsa_build_provenance

json

multidict

6.7.1

admit

predicate_is_slsa_build_provenance

json

networkx

3.6.1

admit

predicate_is_slsa_build_provenance

json

numpy

2.4.6

admit

signer_matches_declared_source

json

oauthlib

3.3.1

admit

predicate_is_slsa_build_provenance

json

orjson

3.11.9

admit

predicate_is_slsa_build_provenance

json

pandas

3.0.5

admit

predicate_is_slsa_build_provenance

json

pillow

12.3.0

admit

predicate_is_slsa_build_provenance

json

propcache

0.5.2

admit

predicate_is_slsa_build_provenance

json

pydantic

2.13.4

admit

predicate_is_slsa_build_provenance

json

pypdfium2

5.12.1

admit

predicate_is_slsa_build_provenance

json

pyrate-limiter

4.4.0

admit

predicate_is_slsa_build_provenance

json

python-dotenv

1.2.2

admit

predicate_is_slsa_build_provenance

json

rapidfuzz

3.14.5

admit

predicate_is_slsa_build_provenance

json

requests

2.34.2

admit

predicate_is_slsa_build_provenance

json

soupsieve

2.9.1

admit

predicate_is_slsa_build_provenance

json

stamina

26.1.0

admit

predicate_is_slsa_build_provenance

json

tenacity

9.1.4

admit

predicate_is_slsa_build_provenance

json

toolz

1.1.0

admit

predicate_is_slsa_build_provenance

json

tqdm

4.70.0

admit

predicate_is_slsa_build_provenance

json

tweepy

4.17.0

admit

predicate_is_slsa_build_provenance

json

typing-extensions

4.16.0

admit

predicate_is_slsa_build_provenance

json

typing-inspection

0.4.2

admit

predicate_is_slsa_build_provenance

json

urllib3

2.7.0

admit

predicate_is_slsa_build_provenance

json

websockets

15.0.1

admit

predicate_is_slsa_build_provenance

json

yarl

1.24.5

admit

predicate_is_slsa_build_provenance

json

Where they fail first

First failing limb	Packages
provenance_published	48
predicate_is_slsa_build_provenance	42
index_resolves	2
signer_matches_declared_source	2

A census of one install set, not a sample of PyPI · no badge, no score · an unattested package is not an unsafe package · publish attestation is not SLSA build provenance

How to cite / re-check

expectations.json summary.json ledger.json method per-package index PEP 740 SLSA provenance

Predicate types

Verified predicate type	Packages
https://docs.pypi.org/attestations/publish/v1	44
https://slsa.dev/provenance/v1	0

Predictions (scored)

Stated before the run	Observed	Verdict
Fewer than half of these distributions will serve any PEP 740 attestation.	44 of 94 served an attestation	met
No distribution in this set will carry a SLSA build provenance predicate.	0 of 94 carried one	met
Both host published roots will refuse at the first limb.	2 roots failed index_resolves	met
Every attestation that verifies will also be in the transparency log.	44 of 44 verified attestations carried a log entry	met

Named reasons

Limb and reason	Packages
provenance_published:no_provenance_published	48
predicate_is_slsa_build_provenance:publish_attestation_not_build_provenance	42
index_resolves:declared_range_unsatisfiable_on_pypi	1
signer_matches_declared_source:signer_repo_mismatch:numpy/numpy!=numpy/numpy-release	1
index_resolves:project_not_on_pypi	1
signer_matches_declared_source:signer_repo_mismatch:tox-dev/py-filelock!=tox-dev/filelock	1

Every limb

Limb	Level	ok	fail	not reached
index_resolves	MUST	92	2	0
provenance_published	MUST	44	48	2
bundle_wellformed	MUST	44	0	50
artifact_bytes_match_index	MUST	44	0	50
signature_verifies	MUST	44	0	50
signer_matches_declared_source	SHOULD	42	2	50
predicate_is_slsa_build_provenance	OBSERVED	0	44	50
attestation_in_transparency_log	OBSERVED	44	0	50

Signer / source mismatches

Package	Declared source	Signed from
numpy	numpy/numpy	numpy/numpy-release
filelock	tox-dev/py-filelock	tox-dev/filelock

Self refusals

Declared	Reason	Latest on PyPI
helixhash>=1.0	declared_range_unsatisfiable_on_pypi	0.1.1
witnessfield>=1.0	project_not_on_pypi	not published

Re-run

python3 -m venv .slsa && .slsa/bin/pip install pypi-attestations
.slsa/bin/python engine/tools/slsa_provenance_run.py expect
.slsa/bin/python engine/tools/slsa_provenance_run.py run

What this cannot tell you

One resolution on one platform at one moment. Wheel filenames are platform specific, so another machine resolves a different artifact list for the same declared versions.
The signer identity is checked against the publisher PyPI reports and then cross checked against the source repository the project declares in its own PyPI metadata. Both facts come from PyPI, so a PyPI that lies about both consistently would pass that limb. The signature verification itself does not depend on PyPI: it goes to the Fulcio chain and the Rekor log.
A 404 from the integrity endpoint is recorded as a refusal, not an absence. The uploader may have chosen not to attest, or may predate PEP 740. Neither case is distinguished here.
Only GitHub publisher slugs are cross checked against declared source. Other publisher kinds refuse that limb by name rather than passing unchecked.
Version ranges float, so re-running resolves a newer set. The expectations file pins exactly which artifacts a given run covered.