The Swiss Cheese Approach to Open Source Security

Are you interested in sharing your Python project with the broader world? Would you like to make it easily installable using pip? How do you create Python packages that share your code in a scalable and maintainable way? This week on the show, Real Python author and former guest Dane Hillard returns to talk about his new book, “Publishing Python Packages.”

Dane shares his research into creating Python packages. We talk about the tools, techniques, and potential pitfalls of publishing your packages. Dane also discusses his experiences unraveling projects and determining dependencies.

We also talk about Dane’s recent conference talk at PyGotham titled “Keeping code safe and modern with semantic searches.” He shares some security tools and practices.

Topics:

• 00:00:00 – Introduction
• 00:01:57 – PyGotham Talk: Keeping code safe and modern with semantic searches
• 00:06:24 – What was the driving reason for starting Publishing Pyhton Packages?
• 00:08:54 – What is CookieCutter?
• 00:11:53 – The book as a research project
• 00:15:20 – Sponsor: CData Software
• 00:16:01 – What is a package?
• 00:18:56 – What is a published package?
• 00:25:37 – What other experiences made you want to write this book?
• 00:28:05 – Where to start?
• 00:33:26 – Balance of examples and explanation
• 00:40:49 – Cohesion and studying the relationships between sections of code
• 00:46:19 – Documentation and tools like Sphinx
• 00:50:18 – Video Course Spotlight
• 00:51:30 – What were you most excited to share in the book?
• 00:54:06 – Additional resources for packaging
• 00:57:17 – What are you excited about in the world of Python?
• 00:57:53 – What do you want to learn next?
• 00:59:30 – Shout outs and plugs
• 01:00:28 – Thanks and goodbye

Show Links:

• About Dane Hillard
• Publishing Python Packages - Manning Early Access Program (MEAP)
• Episode 49: The Challenges of Developing Into a Python Professional
• Keeping code safe and modern with semantic searches - Dane Hillard
• Semgrep: Static analysis at ludicrous speed
• SonarSource: Code Quality & Code Security
• Snyk: Find and automatically fix vulnerabilities in your code
• CookieCutter: Better Project Templates
• Obsidian: A powerful knowledge base on top of a local folder of plain text Markdown files
• The Python Package Index (PyPI): A repository of software for the Python programming language
• PIP: The package installer for Python
• Graphviz -Open source graph visualization software
• cibuildwheel - Builds and tests your wheels across all of your platforms
• Sphinx: A tool that makes it easy to create intelligent and beautiful documentation
• Documenting Python Code: A Complete Guide - Real Python Article
• Python Packaging User Guide - Python Packaging Authority
• How to Publish an Open-Source Python Package to PyPI - Real Python Article
• What Are Python Wheels and Why Should You Care? - Real Python Article
• PEP 517 – A build-system independent format for source trees
• PEP 518 – Specifying Minimum Build System Requirements for Python Projects
• PEP 440 – Version Identification and Dependency Specification
• Episode 29: Resolving Package Dependencies With the New Version of Pip
• Episode 80: Make Your Python App Interactive With a Text User Interface (TUI) - With Will McGugan
• Webpack - Module Federation
• PyGotham 2021
• Publishing Python Packages - Manning Early Access Program (MEAP)

Level up your Python skills with our expert-led courses:

• Using Pygame to Build an Asteroids Game in Python
• Cool New Features in Python 3.10
• Documenting Code in Python

Support the podcast & join our community of Pythonistas