I have been building Trustcheck, a small Python tool that helps developers verify the trust and integrity of Python packages before installing or using them. Trustcheck gathers signals from sources like PyPI metadata, artifact signatures, publisher credibility, GitHub repo, and other trust indicators, and summarizes them so developers (in report form) and machines (in JSON form) can quickly evaluate whether a dependency looks safe to use.
Right now, the project is in really advanced BETA stage, and I am looking for feedback from developers who install Python packages frequently or care about supply-chain security, in order to push this package to a production-grade level.
I have been building Trustcheck, a small Python tool that helps developers verify the trust and integrity of Python packages before installing or using them. Trustcheck gathers signals from sources like PyPI metadata, artifact signatures, publisher credibility, GitHub repo, and other trust indicators, and summarizes them so developers (in report form) and machines (in JSON form) can quickly evaluate whether a dependency looks safe to use. Right now, the project is in really advanced BETA stage, and I am looking for feedback from developers who install Python packages frequently or care about supply-chain security, in order to push this package to a production-grade level.