PyPI Supply Chain Security
summary
The Python Package Index runs mostly on volunteers and serves more than 2 billion requests/day with an estimated cost of $2.3M/month to operate; recent concrete changes include adding API tokens and two‑factor authentication, a rebuilt web stack, a new dependency resolver, and a prototype malware detector. PyPI now integrates the Open Source Vulnerability (OSV) advisory DB and is producing a pip-audit tool, while planned work includes TUF signing of repository metadata, namespaces to prevent squatting, and a canonical hosted build-and-publish service.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:40Key Projects of the PSF
- 1:07The Python Package Index (PyPI)
- 1:37Recent PyPI Projects
- 2:20Accessibility & Access
- 3:16Dependency resolver overhaul
- 3:52In-progress projects
- 4:34CPython Developer-in-Residence
- 5:23Open Source Vulnerabilities
- 5:52The Update Framework
- 6:48Future potential projects
- 7:00Improved malware detection
- 7:44Namespaces
- 9:00Canonical build & publish service
related talks
35mSecuring Python projects Supply Chain
26mSecure Software Supply Chains for Python
24mBuilding a Sustainable Python Package Index
29mMaking Python safer than ever
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
54mState of Python Supply Chain Security
25m"Security considerations in Python Packaging"
25mBad actors vs our community: detecting software supply chain...