How to Use GitHub to Find Vulnerabilities in Packages

Do you need a refresher on using Docker with Python? Would you like to learn how to configure a continuous integration pipeline with modern tools and Docker? This week on the show, Christopher Trudeau is here, bringing another batch of PyCoder’s Weekly articles and projects.

We share a Real Python tutorial from Bartosz Zaczyński about building continuous integration with Docker. Docker provides consistent environments for configuring, testing, and delivering Python applications. In this tutorial, you’ll get up to speed with current Docker and CI techniques.

We also speak with Bill Pollock from No Starch Press about Hacker Initiative. The public nonprofit gives back to and strengthens the hacking community. The 2023 grant cycle is currently open until August 15. We discuss the application process and projects from previous grant recipients.

We cover several other articles and projects from the Python community, including a news update and some resources on implementing metaclasses in Python, creating time machine-style backups, and scanning your project for vulnerabilities.

Topics:

• 00:00:00 – Introduction
• 00:02:26 – PyPI Temporarily Suspended New Registrations
• 00:03:38 – PyPI was subpoenaed
• 00:04:54 – Python 3.12.0 beta 1 released
• 00:05:19 – Build Robust Continuous Integration With Docker and Friends
• 00:13:02 – Metaclasses in Python
• 00:20:03 – Pronouncing SQL - Is there life after SQL?
• 00:22:52 – Video Course Spotlight
• 00:24:25 – pyscan: Python dependency vulnerability scanner, written in Rust
• 00:26:28 – rsync-time-machine.py: Time Machine-Style Backups
• 00:29:20 – Bill Pollock and Hacker Initiative
• 00:34:18 – Previous grant recipients
• 00:36:58 – First Tech Challenge
• 00:43:18 – Large vs small nonprofits
• 00:45:48 – Applying for the 2023 grant cycle
• 00:49:01 – Underserved areas
• 00:51:45 – Thanks and goodbye

News:

• PyPI Temporarily Suspended New Registrations – Due to a large volume of traffic from malicious users, PyPI temporarily suspended new account and project registrations on May 20. The suspension was lifted thirty hours later on May 21.
• PyPI was subpoenaed - The Python Package Index – The PSF received three subpoenas from the US Department of Justice for PyPI user data in March and April of 2023.
• Python Insider: Python 3.12.0 beta 1 released

Show Links:

• Build Robust Continuous Integration With Docker and Friends – In this tutorial, you’ll use Docker and GitHub Actions to build a robust continuous integration pipeline for a multi-container web application consisting of Flask and Redis. Along the way, you’ll learn how to dockerize a Python web application.
• Metaclasses in Python - Real Python Video Course – Metaclasses are an important but mysterious behind-the-scenes mechanism for instantiating classes in Python. In this video course, you’ll learn how Python’s metaclasses work in object-oriented programming.
• Is there life after SQL? - YouTube

Projects:

• pyscan: Python dependency vulnerability scanner, written in Rust - GitHub
• rsync-time-machine.py: Time Machine-Style Backups

Hacker Initiative Links:

• Hacker Initiative – By hackers. For hackers.
• Apply for the 2023 Grant Cycle – Hacker Initiative
• 2022 Grant Recipients – Hacker Initiative

Additional Links:

• Release CPython 3.12.0b1 w/ WASI SDK 20 - brettcannon/cpython-wasi-build
• Episode #149: Coding With namedtuple & Python’s Dynamic Superpowers
• What is FIRST Tech Challenge? - FIRST
• No Starch Press - “The finest in geek entertainment”

Level up your Python skills with our expert-led courses:

• Continuous Integration With Python
• Metaclasses in Python
• Writing Clean, Pythonic Code With namedtuple

Support the podcast & join our community of Pythonistas