my keynote from EuroPython is online! youtu.be/wMPe_KepOjc

Keynote: Securing Python for the next decade - William Woodruff

YouTube video by EuroPython Conference

youtu.be

Trusted publishing is good, but it's still just an authn method and doesn't mean the package itself is safe to run. Good breakdown by @yossarian.net about that

You shouldn't trust Trusted Publishing

blog.yossarian.net

Feross@feross.bsky.social · yesterday

🚨 Another npm worm is live right now. It landed the same week npm turned on publish-time malware scanning, and after npm killed long-lived tokens in favor of OIDC trusted publishing. It propagates through trusted publishing. keyv@6.0.0 even shipped with passing provenance.

“I take the green line to work”

It's not my usual beat, but I wrote a pure-Python ML-DSA verifier. pip install mldsa It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested. Signature verification handles no secrets, so it doesn't need to be constant-time.

Production ML-DSA Verification in 350 Lines of Python

I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust.

words.filippo.io

Excited for the #EuroPython morning keynote today from @yossarian.net, starting at 9AM in S1: ep2026.europython.eu/session/secu...

Securing Python for the next decade

The next decade will challenge many assumptions in Python security. Join us for a session of speculation on secxuring the next decade.

ep2026.europython.eu

README, not https://blog.yossarian.net/2026/07/16/README-not #ai #oss

If you use GitHub Actions to publish to #PyPI, I wrote a blog post outlining what I consider the key things you can do to secure your publishing workflow. snarky.ca/how-to-publi... If you don't use GitHub Actions for publishing, this post will NOT be of interest to you.

How to publish to PyPI using GitHub Actions securely

There have been several security incidents lately that involved compromising GitHub Actions workflows. This has led some to say "GitHub Actions is the weakest link" in publishing and to GitHub publish...

snarky.ca

You shouldn’t trust Trusted Publishing https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing #python #security #oss

We couldn't be happier to welcome @yossarian.net to the EuroPython 2026 speaker lineup! 🎉 At Astral, William builds secure Python tooling. He also maintains zizmor (GitHub Actions linter), pip-audit, and PyCA! 🛡️ 🎟️ europython.eu/tickets/

I wrote a new post for the Astral blog about how we’re building more vulnerability and malware defenses directly into uv: astral.sh/blog/uv-audit

Vulnerability and malware checks in uv

Find vulnerabilities in your Python dependencies with uv audit and prevent installation of known malware with uv's experimental malware detection.

astral.sh

Registering my dissatisfaction with GitHub https://blog.yossarian.net/2026/04/29/Registering-my-dissatisfaction-with-GitHub #oss

Brocards for vulnerability triage https://blog.yossarian.net/2026/04/11/Brocards-for-vulnerability-triage #security #oss

the last two weeks have been ~exciting~ in terms of open source security! I've put together a post on Astral's blog about how we think about open source security: astral.sh/blog/open-so...

Open source security at Astral

Insights and guidance from our engineering team on how Astral secures its tools.

astral.sh

Just cut a new release of `pypi-publish` v1.14.0! It's now verbose by default and prints out hashes. You can opt-out, though. The rest is internal updates, housekeeping, docs. github.com/pypa/gh-acti... / github.com/pypa/gh-acti... #python #Packaging

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

TIL: Rust has safe uninitialized bindings yossarian.net/til/post/rus...

absolut etrog limited edition

Some flexibility with Go’s sumdb https://blog.yossarian.net/2025/12/29/Some-flexibility-with-Go-s-sumdb #security #go #cryptography

At the gpg.fail talk and omg #39c3 You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message. Won’t even blame PGP here. C is unsafe at any speed. gpg has not fixed it yet.

TIL: serde's borrowing can be treacherous yossarian.net/til/post/ser...

so pumped for the ty beta to finally be here, we did so much great work it rules! astral.sh/blog/ty

ty: An extremely fast Python type checker and language server

ty is an extremely fast Python type checker and language server, written in Rust, and designed as an alternative to mypy, Pyright, and Pylance.

astral.sh

Dependency cooldowns, redux https://blog.yossarian.net/2025/12/13/cooldowns-redux #security #oss

I've been SHA-1 pinning ever since I started using GitHub Actions, but I didn't think of transitive (compound) actions, which can use unpinned sub-actions. This is fine 🔥🐶☕🔥 Time to setup zizmor.sh by @yossarian.net for automated scanning, I've had it in my "tools to try" list for a bit.

ICYMI, we want your #security talks at #PyConUS 🤩 CFP closes December 19th #python #supplychain #opensource #oss pycon.blogspot.com/2025/11/trai...

Join us in “Trailblazing Python Security” at PyCon US 2026

PyCon US 2026 is coming to Long Beach, California ! PyCon US is the premiere conference for the Python programming language in North Americ...

pycon.blogspot.com

I'm a big fan of zizmor.sh by @yossarian.net to provide static analysis of GitHub Actions workflows as I'm working on them. The remediation advice is also top notch, for `pull_request_target` as an example: docs.zizmor.sh/audits/#dang...

zizmor - Static Analysis for GitHub Actions

Find and fix potential vulnerabilities in your GitHub workflows and action definitions with zizmor's powerful static analysis.

zizmor.sh

There's a nasty #OpenSource #SupplyChain worm going around named Shai-Hulud. It's also capable of exposing some projects' long-lived PyPI API Tokens. Read more on what's happening, and what you can do to protect your projects. TL,DR: Adopt Trusted Publishing 🔐🚀📦 blog.pypi.org/posts/2025-1...

PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats - The Python Package Index Blog

Shai-Hulud is a great worm, not yet a snake. Attack on npm ecosystem may have implications for PyPI.

blog.pypi.org

We should all be using dependency cooldowns https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns #security #oss

TIL: Safari has built-in WebDriver support yossarian.net/til/post/saf...

All the world's developers are a toddler and X.509 is the neighbor's unfenced pool.

Dear GitHub: no YAML anchors, please https://blog.yossarian.net/2025/09/22/dear-github-no-yaml-anchors #programming #rant