Security and Fellow at the Python Software Foundation š Trans rights, BLM, Minnesoootan, retro gaming, he/himā©ā©
Blog: https://sethmlarson.dev
| Blog | https://sethmlarson.dev |
| Signal | sethmlarson.99 |
RE: https://fosstodon.org/@pypi/116335453780319113
There is a ton in this report, like how @pypi is able to respond so quickly to malware thanks to our network of trusted reporters and how to keep yourself secure both as a maintainer and user of Python packages.
Please welcome Stan Ulbrych @stanfromireland as the newest member of the Python core team!
https://discuss.python.org/t/vote-to-promote-stan-ulbrych/106562
Iād like to propose promoting Stan Ulbrych (@Stanfromireland) to core developer. If youāve been active in the repo lately you probably ran into this enthusiastic triager. Iām now at the proverbial point where applying his āIād merge thisā suggestions feel like a chore ā and cases where I disagree feel like nitpicking. Stan started contributing at the end of 2024, was promoted to triager in June, and accumulated 340+ commits in main. Heās active in datetime (to the point where @pganssle asked ...
You can do a lot of things with @sigstore: sign things with workload identity, get attestations in package managers like PyPI, etc. But there's some limitations. For instance, you can't verify a Sigstore bundle in a 16-bit DOS environment.
Until today. Introducing sigstore-c, which prioritizes portability over features (and correctness!) https://blog.sigstore.dev/sigstore-c/
I clearly need to start a wall of ātrusted publishing would have prevented thisā incidents
Edit: but not axios, maybe! Looks like that one may be full maintainer account compromise.
Simon Willison
Niki
Python Package Index
Hugo van Kemenade
Zach Steindler
Tim Schilling
yossarian (1.3.6.1.4.1.55738)
PyCon US