61/100 top PyPI packages ship full provenance

61/100 top PyPI packages ship full provenance 61 of the 100 most-downloaded packages on PyPI now ship with full provenance. The other 39 — including boto3, the single most-downloaded package on the index — ship with no provenance at all, and not one of the 100 sits in between. PyPI finished rolling out its redesigned project pages on November 6, with a dedicated security tab that shows, per release, whether every file carries a digital attestation proving where it came from. I wanted to know what that badge actually looks like across the packages everyone installs, so I checked the top 100 by 30-day downloads and read the provenance state off each project's security tab. Same signal the UI shows you, no API tricks — PyPI's JSON API doesn't even expose attestations, so the page is the source of truth. How I counted The list is hugovk's top-pypi-packages (30-day download counts, last updated November 1, 2026). For each of the 100 names I fetched pypi.org/pro