Repository navigation
Update provenance for scancode_toolkit-32.5.0-cp314-none-any.whl at PyPI #5396
Description
For the latest release of SCTK on PyPI -scancode_toolkit-32.5.0-cp314-none-any.whl - there is a security warning: INCOMPLETE PROVENANCE for one package scancode_toolkit-32.5.0-cp314-none-any.whl. The other five files (one tar.gz and four wheels) are OK.
The {Security page](https://pypi.org/project/scancode-toolkit/32.5.0/#security) says: "We recommend further investigation before installing files from this release"
There is no security/provenance reported for the scancode-toolkit 33.0.0rc1 pre-release so this may be a one-time issue.
Activity
AyanSinhaMahapatra commentedon Oct 30, 2026
@mjherzog due to a mistake in the release scripts we didn't have scancode-toolkit python3.14 wheels generated through the workflow even though other wheels and the release was published, and this was fixed with:
If you see the pre-release published after that at: https://pypi.org/project/scancode-toolkit/33.0.0rc1/#security it has full provenance.
This cannot be fixed IMHO, and this problem should not be that visible after we release another stable version as the latest release with:
mjherzog commentedon Oct 30, 2026
@AyanSinhaMahapatra Thank you for addressing this quickly. I expected that this was a one-time problem and that is fixed for v33.
I only raised it because of the red banner warning about invalid provenance.