Log in
Topics covered in this episode:
Download audio: https://pscrb.fm/rss/p/dts.podtrac.com/redirect.mp3/pythonbytes.fm/episodes/download/504/who-turned-the-gil-back-on.mp3
- PyPI's redesigned project pages now warn when provenance changes
- gilguard catches the import that turns the GIL back on
- pip 26.3: pylock extras, and pip says plainly that untrusted wheels aren't safe
- All developer tools
- Extras
- Joke
About the show
Sponsored by LongLink: Open-source platform for building and running custom business applications with Python and FastAPI Connect with the hosts
- Michael: Mastodon / BlueSky / X / LinkedIn
- Calvin: Mastodon / BlueSky / X / LinkedIn
- Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
Calvin #1: PyPI's redesigned project pages now warn when provenance changes
- Live now on pypi.org (Nov 6). Announced in July, shaped by user research, funded by OpenSSF and built by Kabu Creative.
- New Security tab on every project page shows each release's provenance state and per-file attestations, with a link to the transparency log.
- Two attestation types: PyPI Publish (uploaded by a Trusted Publisher) and SLSA Build Provenance (ties a file to its source commit, build platform and instructions).
- "No provenance" isn't a malware flag; it means the file's origin can't be cryptographically verified. That's typical for older releases or projects without Trusted Publishing.
- Four new provenance warnings: Incomplete (e.g. wheels via Trusted Publishing but sdist via API token), Inconsistent (mixed build systems or repos), Change (different repo or workflow than last release), Loss (stopped publishing attestations).
- Warnings are meant to catch files that may not have come from the maintainers, such as after an account or publishing-workflow takeover. PyPI says a Change of Provenance "can also indicate a compromised pipeline or account takeover," and an unexpected Loss of Provenance should be treated "with skepticism until verified.”
- Warnings now sit at the top of the page with yanked, archived and pre-release banners. A quarantine banner overrides all of them. Sidebar metadata is labeled "PyPI data" or "Data verified by PyPI."
- Release files tab gets search, filters, a per-file provenance column and orange icons for "late" files (uploaded more than 14 days after release). Those only appear on releases from before July 2026, when PyPI started rejecting new files after 14 days.
Michael #2: gilguard catches the import that turns the GIL back on
gilguard catches a nasty free-threading surprise: importing a C extension without declared free-threading support can turn the GIL back on for the rest of the process. Import gilguard first and it raises a detailed error naming the extension, distribution/version, import chain, and the line of your code responsible.
- A transitive dependency can undo your move to free-threaded Python. Fail at the offending import instead of discovering lost parallelism in a benchmark.
- Uses import hooks plus CPython's warning path to catch GIL activation; GILEnabledError inherits BaseException, so even except Exception won't swallow it.
- python -m gilguard audits installed top-level packages in fresh interpreters. Supports targeted modules and JSON output; exits 1 when it finds an offender for CI.
- The audit misses extensions loaded lazily on first use. Exercise those paths in tests with gilguard installed early; one process can identify only its first GIL-flipping import.
- GILGUARD_ACTION=warn reports without stopping; off permits standard builds. Default mode raises on standard Python or an already-enabled GIL. PYTHON_GIL=0 prevents activation, so the guard cannot detect offenders there.
- Published on PyPI as 0.1.0. Install with uv pip install gilguard. Python 3.13+, MIT; no runtime dependencies.
Calvin #3: pip 26.3: pylock extras, and pip says plainly that untrusted wheels aren't safe
- pip 26.3 released Nov 2. Its security policy now says pip "has never considered installing untrusted wheels safe," because Python's import system is dynamic, so pip can't guarantee installing a wheel won't execute third-party code (#14412).
- The change: pip blocks unexpected imports during wheel installation "to avoid loading code from packages being replaced." It loads what it needs for installing and error reporting up front (PR #14247, merged Nov 2: https://github.com/pypa/pip/pull/14247).
- CLI vs. library use: from the command line, imports stay blocked until pip exits. Code that calls pip programmatically gets warnings after control returns.
- Rolled out in steps: pip 26.1 started warning ("Unexpected import of '...' after pip install started. pip 26.3 will enforce this behavior change"), and 26.3 turns it into an error. Tracking issue #13842 collected reports before enforcement: https://github.com/pypa/pip/issues/13842
- What tripped it in the wild: a
.pthstartup hook at Pradyun Gedam's workplace that registers an atexit handler to report interpreter usage metrics over HTTP (https://github.com/pypa/pip/issues/13842#issuecomment-4613463933), plus warnings involvinglark_oapiandrich._emoji_codes. - Escape-hatch debate: the author, Damian Shaw (notatallshaw), suggested appending module names to
pip._internal.commands.install._EAGER_IMPORTS. Pradyun objected that this requires importing frompip._internal, that importing pip's install command is expensive (about 689 ms with no .pyc files and a cold filesystem cache), and that pip isn't necessarily installed in every environment. Shaw's reply: it "just moves where the import cost is," and turning the warning into an error is "crucial." - Interrupted installs: pip now writes recovery metadata and reports recovery failures and where it kept backups. An interrupted uninstall may need manual recovery, and an interrupted --target install can leave a partial target directory.
- Also in 26.3:
-r pylock.toml[extra1,extra2]for extras,--group pylock.toml:docsfor non-default groups,--no-binarywith pylock files, and pip refuses to follow an HTTP redirect to a file: URL.
Michael #4: All developer tools
HeyUtils is a collection of 306 free developer utilities in 41 categories, with no account or installation required. The full catalog covers data conversion, APIs, networking, DevOps, frontend work and binary protocols. Python developers get model generation and packaging helpers alongside the everyday formatters and decoders worth bookmarking.
- One bookmark for the tiny jobs that interrupt coding: inspect a payload, compare configs, decode a token or figure out a cron schedule.
- Data tools include JSON/YAML/TOML conversion, CSV joins, JSONPath and JMESPath testers, a jq playground, and a SQLite viewer with read-only queries.
- Python-specific options go beyond regex: generate dataclasses or Pydantic models from JSON, check PEP 440 versions, and inspect requirements.txt or pyproject.toml dependencies.
- The collection also covers JWT/OAuth debugging, DNS and TLS checks, Docker Compose, Kubernetes YAML, GitHub Actions, and frontend helpers such as color contrast checks.
- Most tools process input locally, according to the site. Network tools make requests after you start them and explain what they send; don't assume every page is offline.
- Generated models need review: sample data cannot describe a complete validation contract, and dataclass type hints do not validate incoming values.
Extras
Calvin:
- Coldframe: a stdlib-only honeypot that poses as a supermarket fridge controller** Michael:
- Announcing new Security Developer at the PSF
- Brett Smith is joining the PSF as a Security Developer, a new role funded by Anthropic. He'll work with Seth Larson and Mike Fiedler on vulnerability response and PyPI malware removal, with more time for proactive work as the team's workload grows.
- More paid security capacity for the Python and PyPI infrastructure we depend on every day.
- The PSF reports 3-4x the volume of reports and CVEs for Python and pip compared with a year ago.
- Malware published and removed from PyPI is up 60% year over year. That's a workload measure, not a claim that 60% more packages are malicious.
- Planned work includes scaling PyPI's autonomous quarantine program and streamlining how the Python Security Response Team handles reports.
- Smith brings software development and Linux administration experience, including work at W3C and Software Freedom Conservancy.
- Brett Smith is joining the PSF as a Security Developer, a new role funded by Anthropic. He'll work with Seth Larson and Mike Fiedler on vulnerability response and PyPI malware removal, with more time for proactive work as the team's workload grows.
Joke: No papa
Download audio: https://pscrb.fm/rss/p/dts.podtrac.com/redirect.mp3/pythonbytes.fm/episodes/download/504/who-turned-the-gil-back-on.mp3
