pypi:datasette@0.65.5
PyPI · checked 21 Oct 2026, 23:16 UTC · checker 2026-10-19.2 · log index 944
Record issued 21 Oct 2026
Issued 21 Oct 2026, 23:16 UTC · pypi:datasette@0.65.5
quiet
Its install steps ran with decoy credentials in reach and touched nothing we watch.
It ran here and reached for nothing on the network. That is evidence, not proof: code can wait for a different machine.
The trace shows what a step attempted. A quiet trace is evidence, not proof.
Phases
This record does not state its phases one by one; npm records from checker 2026-11-03.1 and Python records from 2026-11-04.3 on do.
Install steps
pypi:datasette has no install step of its own.
No dependency runs anything at install.
What the run reached
No install step reached anything we watch.
- Programs
- python3
- Credentials read
- No credential file or variable was opened.
- Credentials sent
- No decoy left the box.
First import
No first import was recorded for this check.
Dependencies
27 of 27 installed, as npm would on linux x64 musl.
Show all 27
- asgiref==3.12.1
- click==8.5.0
- click-default-group==1.2.4
- jinja2==3.1.6
- hupper==1.12.1
- httpx==0.28.1
- pluggy==1.7.0
- uvicorn==0.54.0
- aiofiles==25.1.0
- janus==2.0.0
- asgi-csrf==0.11
- pyyaml==6.0.3
- mergedeep==1.3.4
- itsdangerous==2.2.0
- setuptools==84.2.1
- pip==26.2.2
- platformdirs==4.13.5
- typing-extensions==4.16.0
- flexcache==0.3
- flexparser==0.4
- markupsafe==3.0.4
- anyio==4.15.1
- certifi==2026.10.19
- httpcore==1.0.9
- idna==3.20
- h11==0.16.0
- python-multipart==0.0.32
Since the previous version
No comparison with an earlier version was made for this check.
Sandbox
network=none; capabilities=all-dropped; rootfs=read-only; user=nobody; harness=separate-user
Signature and transparency log
- level
- quiet
- verdict
- approved
- reasonCode
- ran_ok
- keyId
- 322a2536e0d5ec8e
- algorithm
- ed25519
- checker
- 2026-10-19.2
- issuedAt
- 2026-10-21T23:16:55Z
- contentSha256
- ca5faf528d4c1acc22e78b0274257435683ae6c75cf275939f2b92a10e498dbb
- contentSizeBytes
- 399477 (390 KB)
- outputSha256
- b11b4d625d3ee8ba6ef7c9117cbe9dc1627e0dbb1dea6aeb56624f3a3aba145b
- log index
- 944
Verify the signature yourself, in your browser, at /verify. Kenwea is not in that loop.
Inclusion proofCheckpointKey list
Issued 21 Oct 2026, 23:16 UTC
What this does and does not say
The claim is about the bytes, not the name.
The signature covers these exact bytes. Another version is another check.
A quiet trace is evidence, not proof.
Code that only runs later, when your app calls it, is out of reach.
A signature is not an endorsement.
It says what happened, not that the code is good.
Twenty checks an hour for each network address. When a limit is ours, the record says unfinished and names it.