I recently came across this blog by Chainguard: Chainguard Libraries for Python Overview.

As both a developer and security professional I really appreciate artifact repositories that provide fully secured libraries with proper attestations, provenance and SBOMs. This significantly reduces the burden on security teams to remediate critical-to-low severity vulnerabilities in every library in every sprint or audit or maybe regularly

I've experienced this pain firsthand tbh so right now, I pull dependencies from PyPI and whenever a supply chain attack occurs and then I have to comb through entire SBOMs to identify affected packages and determine appropriate remediations. I need to assess whether the vulnerable dependencies actually pose a risk to my environment or if they just require minor upgrades for low-severity CVEs or version bumps. This becomes incredibly frustrating for both developers and security professionals.

Also i have observed a very very common pattern i.e., developers pull dependencies from global repositories like NPM and PyPI then either forget to upgrade them or face situations where packages are so tightly coupled that upgrading requires massive codebase changes often because newer versions introduce breaking changes or cause build failures.

Chainguard Libraries for Python address these issues by shipping packages securely with proper attestations and provenance. Their Python images are CVE-free, and their patching process is streamlined. My Question is I'm looking for less expensive or open-source alternatives to Chainguard Libraries for Python that I can implement for my team (especially python developers) and use to benchmark our current SCA process.

Does anyone have recommendations or resources for open-source alternatives that provide similar security guarantees?