#492 Codeberg Puts Head in Sand

Topics covered in this episode:

• Python 3.12.14, 3.11.16, 3.10.21 - security releases
• Codeberg’s AI-code ban tests its role as a GitHub alternative
• Brett Cannon: what's missing for reproducible builds on PyPI
• • nothing records the source code a distribution came from. direct_url.json captures it when you install from a repo or archive, so the fix is putting the same info in sdist/wheel metadata.
• • recording the build tools. Wheels can already do this via PEP 770 SBOMs in .dist-info/sboms/ - sdists can't, since they're a tarball plus a precalculated PKG-INFO with nowhere to hang extra metadata. Either "don't use sdists" or an sdist v2.
• Extra extra extra, hear all about it
• Extras
• Joke

See the full show notes for this episode on the website at pythonbytes.fm/492