diff --git a/dev-python/pypi-attestations/Manifest b/dev-python/pypi-attestations/Manifest
index 2d475693a1373..88b4d3d5c3173 100644
--- a/dev-python/pypi-attestations/Manifest
+++ b/dev-python/pypi-attestations/Manifest
@@ -1,2 +1,4 @@
 DIST pypi_attestations-0.0.27.tar.gz 123543 BLAKE2B 11e6dabcb58c5201af4df0392784c5cda02eabfde4d6d2cd39464d3bf89fa7a54495c435e86e5b7031ed7d9a85230ec273279d2f8ab86ba5e1dec2eb431829e4 SHA512 206c6aaf523a0143defe2ef35ee886d8d5d3cc7d3010a5f1ef6d5e9f0af3dac56b2a3b3af87256b50bf475d88ff397ea35f7512aac540a2918e8a52c91ac6e03
 DIST pypi_attestations-0.0.27.tar.gz.provenance 9602 BLAKE2B 70ace0f798e6bdeb1be3af64c78ba3d774a2944239776728c70c8d06f91c7a6fef1f929ca63ed52ffd83e4d623b1dfe457a670ab5c9e72908b59d93d1b54a3c5 SHA512 9cd9bed860bedd479800c52637e24a9fcbe9f03a8ea8c25a5c4029e4f8c61743843dbb583afd7958c6fa8418ef734f08d4a55a7c4222956fe1f934004c14cdf6
+DIST pypi_attestations-0.0.28.tar.gz 124805 BLAKE2B f6a2227b715846199f632aa3476fd1b7c32a39e84f5deacdb088e7a649358182f5a1acb3bf2bc6b768c096e6015183ff540f55e020d3f6373dc2fc1bd09012a0 SHA512 96a24272ce62808b4401dc528035caab959bd89a82e790855453aba8e864cc4550cd3734a44734e67be98f569c9c6ffad5e4d4ba23facf4bd2c491ab6c47c713
+DIST pypi_attestations-0.0.28.tar.gz.provenance 9454 BLAKE2B 8c23ae6dd16cefb5036cc3fc6c3d31a8022d1ea53ca4aaae08e5a026b008731eb7a5404ad0ac13915aaf15dae05b9d79ee09ea8c5fff880f919aaa2ca4d910dd SHA512 33e4ab27a58f4a9a578c05875dcbac1a0a543bcdc30a8c89f07538bc8d4d4cdfbaa2a0e207a503dc8462e607a7a56836938b6e2ef9fb74d9468514f8b0ea0ffc
diff --git a/dev-python/pypi-attestations/metadata.xml b/dev-python/pypi-attestations/metadata.xml
index aa810c8f44b77..84d24fd6b0a19 100644
--- a/dev-python/pypi-attestations/metadata.xml
+++ b/dev-python/pypi-attestations/metadata.xml
@@ -6,7 +6,7 @@
 	</maintainer>
 	<stabilize-allarches/>
 	<upstream>
-		<remote-id type="github">trailofbits/pypi-attestations</remote-id>
+		<remote-id type="github">pypi/pypi-attestations</remote-id>
 		<remote-id type="pypi">pypi-attestations</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/dev-python/pypi-attestations/pypi-attestations-0.0.28.ebuild b/dev-python/pypi-attestations/pypi-attestations-0.0.28.ebuild
new file mode 100644
index 0000000000000..0687f5af949ba
--- /dev/null
+++ b/dev-python/pypi-attestations/pypi-attestations-0.0.28.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYPI_VERIFY_REPO=https://github.com/pypi/pypi-attestations
+PYTHON_COMPAT=( python3_{11..13} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Convert between Sigstore Bundles and PEP-740 Attestation objects"
+HOMEPAGE="
+	https://github.com/pypi/pypi-attestations/
+	https://pypi.org/project/pypi-attestations/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~ppc64"
+
+RDEPEND="
+	dev-python/cryptography[${PYTHON_USEDEP}]
+	dev-python/packaging[${PYTHON_USEDEP}]
+	=dev-python/pyasn1-0.6*[${PYTHON_USEDEP}]
+	>=dev-python/pydantic-2.10.0[${PYTHON_USEDEP}]
+	dev-python/requests[${PYTHON_USEDEP}]
+	dev-python/rfc3986[${PYTHON_USEDEP}]
+	=dev-python/sigstore-4*[${PYTHON_USEDEP}]
+	dev-python/sigstore-models[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pretend[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_PLUGINS=()
+distutils_enable_tests pytest