Secure Software Supply Chains for Python

Secure Software Supply Chains for Python

Explore the critical topic of secure software supply chains in Python during this PyCon US talk. Delve into the robust ecosystem of open-source Python packages and the security challenges they present. Examine common supply chain attacks, including man-in-the-middle, typosquatting, and dependency confusion. Learn about protective measures such as HTTPS implementation, lockfile usage, and vulnerability notifications. Discover potential improvements to enhance ecosystem security, including package signing, audited repositories, and the Update Framework. Gain insights into the importance of funding open-source projects and the implementation of namespaces on PyPI to strengthen the overall Python software supply chain.