I will audit your python uv lockfile against pypi signed attestations

Do you know whether the Python packages you ship with were actually built from the repositories they claim to come from? This audit checks that for every package in your uv.lock, using the signed publishing records (Sigstore attestations) PyPI already keeps.

You get one row per package: how many pinned files carry a signed record, the repository named in the signature, the repository the package declares, and a verdict (MATCH, MISMATCH, NO-REPO-DECLARED, UNATTESTED, VERIFY-FAILED or SKIPPED). Every signature is checked against the exact file hash your lock pins, so a file that differs from the one that was signed shows up as a failure. Optional: a check against your own list of expected repositories, a stronger test than trusting package metadata. Plus a short written read of the unsigned and mismatched packages and what to do about each, and one re-check after your changes within 30 days.

What I need: your uv.lock. Nothing is installed or run from your project; the audit reads the lock and PyPI's public records only.

Limits: MATCH is a consistency check, not proof a package is safe. Non-PyPI indexes are listed as SKIPPED. pip and Poetry lockfiles are not supported yet.