Back in 2019 we kicked off efforts to integrate with GitHub secret scanning. Due to the complexity in nature, the completed integration launched in 2021, with the volunteer-led effort by Joachim Jablon (@ewjoachim) and the GitHub team.
Starting today, newly registered users must enable 2FA before they can perform any management actions on PyPI. This change comes after we've also added a rule for accounts to have a verified, primary email address for the same set of management actions.
As a reminder, PyPI has supported adding 2FA since 2019.
👋 Hi there! I'm Mike Fiedler (@miketheman) I've been a Python Package Index (PyPI) contributor since early 2021, and became a maintainer in 2022. Now I'm joining the PSF to work on PyPI full-time as the first PyPI Safety & Security Engineer.
PEP 715, deprecating bdist_egg/.egg
uploads to PyPI has been
accepted.
We'll begin the process of implementing this today.
Please note that this does NOT remove any existing uploaded eggs from PyPI.
We are pleased to announce that the PSF has received funding from the Center for Security and Emerging Technology (CSET) to develop and improve the infrastructure for malware reporting and response on PyPI. This project will be executed over the coming year.
Beginning today, all uploads from user accounts with 2FA enabled will be required to use an API Token or Trusted Publisher configuration in place of their password.
Hi there! I'm Mike, the newest member of the PyPI admin team. Nice to meet you!
We've been working on reducing the amount of IP address data we store, and we're making progress.
One of the key security promises that PyPI makes is that when you're downloading something, that only the people associated with that project are going to be able to upload, delete, or otherwise modify a project. That when you look at that project and see that it is owned by someone that you trust, that you can be assured that nobody else is making changes to that package on PyPI.
In March and April 2023, the Python Software Foundation (PSF) received three (3) subpoenas for PyPI user data. All three subpoenas were issued by the United States Department of Justice. The PSF was not provided with context on the legal circumstances surrounding these subpoenas. In total, user data related to five (5) PyPI usernames were requested.
If you are someone who is currently uploading signatures, your package uploads will
continue to succeed, but any PGP signatures will be silently ignored. If you are
someone who is currently downloading PGP signatures, existing signatures
SHOULD continue to be available 1, but no new signatures will be made available.
The related API fields such as has_sig have all been hardcoded to always be
False.