#504: Who turned the GIL back on?
30 min
Topics covered in this episode: PyPI's redesigned project pages now warn when provenance changes gilguard catches the import that turns the GIL back on pip 26.3: pylock extras, and pip says plainly that untrusted wheels aren't safe All developer tools Extras Joke Watch on YouTube About the show Sponsored by LongLink: Open-source platform for building and running custom business applications with Python and FastAPI Connect with the hosts Michael: Mastodon / BlueSky / X / LinkedIn Calvin: Mastodon / BlueSky / X / LinkedIn Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: PyPI's redesigned project pages now warn when provenance changes Live now on pypi.org (Nov 6). Announced in July, shaped by user research, funded by OpenSSF and built by Kabu Creative. New Security tab on every project page shows each release's provenance state and per-file attestations, with a link to the transparency log. Two attestation types: PyPI Publish (uploaded by a Trusted Publisher) and SLSA Build Provenance (ties a file to its source commit, build platform and instructions). "No provenance" isn't a malware flag; it means the file's origin can't be cryptographically verified. That's typical for older releases or projects without Trusted Publishing. Four new provenance warnings: Incomplete (e.g. wheels via Trusted Publishing but sdist via API token), Inconsistent (mixed build systems or repos), Change (different repo or workflow than last release), Loss (stopped publishing attestations). Warnings are meant to catch files that may not have come from the maintainers, such as after an account or publishing-workflow takeover. PyPI says a Change of Provenance "can also indicate a compr...