PyPI Security Q4 2019 Request for Information period opens.

The Python Software Foundation Packaging Working Group has received funding from Facebook research to develop and deploy of enhanced security features to PyPI.

PyPI is a foundational component of the Python ecosystem and broader computer software and technology landscape. This project aims to improve the security and accessibility of PyPI for all users worldwide, whether they are direct users like project maintainers and pip installers or indirect users. The impact of this work will be highly visible and improve crucial features of the service.

Specifically, this project aims to implement verifiable cryptographic signing of artifacts and infrastructure to support automated detection of malicious uploads to the index.

We plan to begin the project in December 2019. Because of the size of the project, funding has been allocated to secure one or more contractors to complete the development, testing, verification, and assist in the rollout of necessary features.

Register Interest

To receive notification when our Request for Information period closes and the Request for Proposals period opens, please register your interest here.

What is the Request for Information period?

A Request for Information (RFI) is a process intended to allow us (The Python Software Foundation) and potential contractors to openly share information to improve the scope and definition of the project at hand. Also, we encourage stakeholders in the community with expertise in the project areas to contribute their viewpoints on open questions for the scope of the work.

We hope that it will help potential contractors better understand the work to be completed and develop better specified proposals. Additionally we have designed the RFI with an open nature in order to expose the project to multiple perspectives and help shape the direction for some choices in the project.

The Request for Information period opens today, August 28, 2019, and is scheduled to close September 18, 2019.

After the RFI period closes, we will use the results of the process to prepare and open a Request for Proposals to solicit proposals from contractors to complete the work.

More Information

The full version of our Request for Information document can be found here.

Participate!

Our RFI will be conducted on the Python Community Discussion Forum. Participants will need to create an account in order to propose new topics of discussion or respond to existing topics.

All discussions will remain public and available for review by potential proposal authors who do not wish to or cannot create an account to participate directly.

Python Software Foundation Fellow Members for Q1 & Q2 2019

We are happy to announce our newest PSF Fellow Members! This group includes nominated Fellows from Q1 and Q2 of 2019.

Q1 2019

Christoph Gohlke

Q2 2019

Aaron Yankey

Twitter

Chris Jerdonek

Florian Bruhin

GitHub, Twitter, Main project

Matt Lebrun

Twitter, Instagram, Website

Micaela Reyes

Twitter, Instagram, Website

Pradyun Gedam

Twitter, Website

Rami Chowdhury

GitHub, Twitter, Mastodon

Tania Allard

Twitter, Website

Congratulations! Thank you for your continued contributions. We have added you to our Fellow roster online.

The above members have contributed to the Python ecosystem by teaching Python, maintaining popular libraries/tools, maintaining pip, organizing Python events, starting Python communities in their home countries, and overall being great mentors in our community. Each of them continues to help make Python more accessible around the world. To learn more about the new Fellow members, check out their links above.

Let's continue to recognize Pythonistas all over the world for their impact on our community. Here's the criteria our Work Group uses to review nominations:

• For those who have served the Python community by creating and/or maintaining various engineering/design contributions, the following statement should be true:
• Nominated Person has served the Python community by making available code, tests, documentation, or design, either in a Python implementation or in a Python ecosystem project, that 1) shows technical excellence, 2) is an example of software engineering principles and best practices, and 3) has achieved widespread usage or acclaim.
• For those who have served the Python community by coordinating, organizing, teaching, writing, and evangelizing, the following statement should be true:
• Nominated Person has served the Python community through extraordinary efforts in organizing Python events, publicly promoting Python, and teaching and coordinating others. Nominated Person's efforts have shown leadership and resulted in long-lasting and substantial gains in the number and quality of Python users, and have been widely recognized as being above and beyond normal volunteering.
• If someone is not accepted to be a fellow in the quarter they were nominated for, they will remain an active nominee for 1 year for future consideration.
• It is suggested/recommended that the nominee have wide Python community involvement. Examples would be (not a complete list - just examples):
• Someone who has received a Community Service Award or Distinguished Service Award
• A developer that writes (more than one) documentation/books/tutorials for wider audience
• Someone that helps translate (more than one) documentation/books/tutorials for better inclusivity
• An instructor that teaches Python related tutorials in various regions
• Someone that helps organize local meet ups and also helps organize a regional conference
• Nominees should be aware of the Python community’s Code of Conduct and should have a record of fostering the community.
• Sitting members of the PSF Board of Directors can be nominated if they meet the above criteria.

If you would like to nominate someone to be a PSF Fellow, please send a description of their Python accomplishments and their email address to psf-fellow at python.org. We are accepting nominations for quarter 4 through November 20, 2019. More information is available at: https://www.python.org/psf/fellows/.

Humble Bundle by No Starch supports the Python Software Foundation!

We are super excited to announce that the Python Software Foundation is featured as a charity in a Humble Bundle by No Starch Press this month.

This bundle features books such as Python Playground, Mission Python, Invent your own Computer Games with Python, and so much more.

Click here to see all the books being featured and GET THE BUNDLE before it closes! The bundle will run from August 19th to September 2nd (11am Pacific). Proceeds received help charities such as the Python Software Foundation (PSF). Once you click to get your bundle, you can also choose where your money goes if you'd like to customize the split of proceeds.

Humble Bundle sells games, ebooks, software, and other digital content. Their mission is to support charity while providing awesome content to customers at great prices. Thanks to past Humble Bundles that the PSF has been a part of, this program has helped the PSF raise more than $300,000 since 2017! The PSF and the Python community thank Humble Bundle and all of the featured products that have selected the PSF as one of their charities. This funding has had a positive impact for Pythonistas all around the world.

No Starch is a long time community contributor supporting the PSF in various Bundles and supporting Young Coder classes that happen at PyCon US.  “As one of the leading publishers of Python books worldwide, No StarchPress is very excited to support the organization at the core of the Python programming language” said No Starch Press Founder Bill Pollock. “Python is at the core of so much technical work today and very much at the core of our publishing program.”

The PSF staff and board of directors send a big "Thank You!" to everyone involved.