Solving the Phantom Dependency Problem for Python Packages
summary
Phantom dependencies are bundled native libraries that aren’t listed in Python metadata, causing SCA and vulnerability checks to miss them; the concrete fix is a packaged SBOM directory PEP 770 (dist-info/sboms) that audit tools can write into wheels. Auditwheel is patched to emit those SBOMs and a demo shows auditwheel generating a CycloneDX SBOM that lets SIFT detect libwebp libtiff libpng previously invisible. PEP 770 is accepted after ~5 months of review and targets PyPI’s hundreds of thousands of packages.
AI-written summary · about
chapters (21)
- 0:00Welcome
- 1:56What to expect from this talk
- 2:39Phantom dependencies defined
- 3:46Demo: Pillow phantom deps
- 5:34Software Bill of Materials
- 6:58Why scanners fail
- 8:43Legitimate phantom deps
- 10:51Wheels and phantom deps
- 12:34Python as glue language
- 13:18Solving with SBOMs
- 14:19PEP 770 introduction
- 15:24Contributing to SBOMs
- 17:55Social side of standards
- 18:36Skepticism on SBOMs
- 20:21Open source strategies
- 22:28Slow standards process
- 23:51PEP 770 success
- 24:12Supporting the Python Software Foundation
- 24:56Checking vulnerabilities
- 28:03Key takeaways
- 29:33Q&A
related talks
26mPhantom Dependencies: is your requirements.txt haunted?
26mSecure Modern and Simple Dependency Management with PDM and Friends
35mSecuring Python projects Supply Chain
25m"Security considerations in Python Packaging"
30mThe Evolutionary Saga of Python Packaging
27mPython in Bazel
25mInside the Cheeseshop: How Python Packaging Works
44mNobody Expects the Python Packaging Authority