William Woodruff

The world of open source is undergoing numerous seismic changes, and Python is no exception. This keynote will focus on security: we'll extrapolate (and speculate) on the task of securing Python for the next decade of usage by open source maintainers, corporations, tinkerers, vibe coders, and...

End-to-end signing and verification is one of the hardest technical and social challenges in open source packaging: it rests at the fault lines of error- and misuse-prone cryptography, long-term secret management, and identity/trust bootstrapping.

The Python ecosystem has historically relied on OpenSSL (and its myriad forks) to provide an implementation of X.509 path validation, a little-known but essential component of every secure HTTPS connection made on the modern Internet.

Code signing is coming to the Python packaging ecosystem, in the form of Sigstore : individual package maintainers and users will be able to sign for and verify the authenticity of their Python packages, respectively, without the historical and technical baggage of PGP.

Every time you fetch a package from the Python Package Index (PyPI) you’re making an implicit security decision. However, the security implications of package indexes are not typically well understood by developers.