Skip to content
Sign in
Artwork for Python Bytes
Python Bytes · August 18 · 39 min

#492 Codeberg Puts Head in Sand

Topics covered in this episode: Python 3.12.14, 3.11.16, 3.10.21 - security releases Codeberg’s AI-code ban tests its role as a GitHub alternative Brett Cannon: what's missing for reproducible builds on PyPI nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata. recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2. Extra extra extra, hear all about it Extras Joke See the full show notes for this episode on the website at pythonbytes.fm/492

0:00-39:17
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

Topics covered in this episode:
  • Python 3.12.14, 3.11.16, 3.10.21 - security releases
  • Codeberg’s AI-code ban tests its role as a GitHub alternative
  • Brett Cannon: what's missing for reproducible builds on PyPI
    • nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata.
    • recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2.
  • Extra extra extra, hear all about it
  • Extras
  • Joke
See the full show notes for this episode on the website at pythonbytes.fm/492
links2

more episodes

All episodes