Topics covered in this episode:
- Python 3.12.14, 3.11.16, 3.10.21 - security releases
- Codeberg’s AI-code ban tests its role as a GitHub alternative
- Brett Cannon: what's missing for reproducible builds on PyPI
- nothing records the source code a distribution came from.
direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata.
- recording the build tools. Wheels can already do this via PEP 770 SBOMs in
.dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2.
- Extra extra extra, hear all about it
- Extras
- Joke
See the full show notes for this episode on the website at
pythonbytes.fm/492 
