# PEP 740: Index support for digital attestations

**URL:** <https://discuss.python.org/t/pep-740-index-support-for-digital-attestations/44498>\
**Category:** Standards\
**Created:** [January 29, 2024, 9:59pm UTC](https://discuss.python.org/t/pep-740-index-support-for-digital-attestations/44498 "2024-01-29T21:59:37Z")\
**Posts on this page:** 1\
**Showing post:** 11

<div class="post-metadata">

**Author:** ![dustin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/dustin/32/149_2.png) [@dustin](https://discuss.python.org/u/dustin)\
**Post date:** [February 22, 2024, 11:00pm UTC](https://discuss.python.org/t/pep-740-index-support-for-digital-attestations/44498/11 "2024-02-22T23:00:41Z")

</div>

> [@woodruffw](#):
>
> Makes sense to me! I’ll try to find a cite for this, but I _think_ repeated `data-provenance` on the same HTML element isn’t valid in HTML5

Ah, I think you’re right. We could make `data-provenance` some sort of array (I think a JSON array would be valid?).

> [@woodruffw](#):
>
> How do you feel about only serving provenance via the Simple JSON API? That would sidestep the format woes , but I’m not sure if maintaining parallels between the two APIs is important here (vulnerabilities, etc. only exist in the JSON API, so there’s some precedent).

I think we should try to maintain parity. The JSON API isn’t standardized, so an installer like `pip` wouldn’t want to integrate against it, which would prevent verification downstream (also, hence [https://discuss.python.org/t/draft-pep-adding-vulnerability-data-to-the-simple-api-for-package-indexes/](https://discuss.python.org/t/draft-pep-adding-vulnerability-data-to-the-simple-api-for-package-indexes/))

---

_[View the full topic](https://discuss.python.org/t/pep-740-index-support-for-digital-attestations/44498)._