We’re excited to announce the continuation of Seth Larson’s work within the Safety Developer-in-Residence function by way of the tip of 2024 because of continued help from Alpha-Omega. (This six month extension is meant to align the renewal interval for this function with the calendar 12 months going ahead).
The primary 12 months of the Safety Developer-in-Residence initiative has been a hit, seeing a number of enhancements to the Python ecosystem’s safety posture. These enhancements embrace authorizing the PSF as a CVE Numbering Authority, migrating the CPython launch course of to an remoted hosted construct platform, and producing complete Software program Invoice-of-Supplies paperwork for CPython artifacts.
Open supply software program safety continues to evolve, this 12 months noticed new rules for software program safety just like the EU Cyber Resiliency Act (CRA) and evolving threats to open supply just like the backdoor of xz-utils.
The PSF is wanting ahead to persevering with our funding within the safety of the Python ecosystem and everybody who is determined by Python software program. For the rest of 2024, priorities for Safety Developer-in-Residence function embrace:
- Formalization of the Python Safety Response Group (PSRT) and processes for dealing with vulnerability reviews and fixes.
- Creating a technique for Software program Invoice-of-Supplies paperwork and Python packages.
- Finishing the migration of the CPython launch course of and era of SBOM paperwork for the macOS installer.
- Continued engagement with the Python neighborhood selling safety best-practices and requirements.
For updates on these and different initiatives, take a look at Seth’s weblog.
The
PSF is a non-profit whose mission is to advertise, defend, and advance
the Python programming language, and to help and facilitate the
progress of a various and worldwide neighborhood of Python programmers.
The PSF helps the Python neighborhood utilizing company sponsorships,
grants, and donations. Are you curious about sponsoring or donating to
the PSF so it may well proceed supporting Python and its neighborhood? Examine
out our sponsorship program, donate straight right here, or contact our group!
