#492 Codeberg Puts Head in Sand

About this episode

Topics covered in this episode: • Python 3.12.14, 3.11.16, 3.10.21 - security releases • Codeberg’s AI-code ban tests its role as a GitHub alternative • Brett Cannon: what's missing for reproducible builds on PyPI • • nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata. • • recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2. • Extra extra extra, hear all about it • Extras • Joke Watch on YouTube Sponsored by Logfire from Pydantic pythonbytes.fm/logfire This episode is brought to you by Pydantic Logfire. It's observability for AI apps from the team behind Pydantic - agents, LLMs, APIs, database, and infrastructure in a single trace, queried with Postgres-compatible SQL. Your coding agent can query it too, through their MCP server. I'll tell you more later. Connect with the hosts • Michael: Mastodon / BlueSky / X / LinkedIn • Calvin: