I built a CLI to verify PyPI package attestations...

Python developers install packages from PyPI every day with pip. Most of the time we trust that the package we install is exactly what the maintainer intended to publish. But questions often come up: Who actually published this release? Does the package have verifiable provenance? Has the repository changed since the last version? Are there any known vulnerabilities? To explore these questions, I built trustcheck. What trustcheck does trustcheck is a CLI tool that inspects trust signals for PyPI