Posts Tagged ‘PSF’
[PyConUS2025] Phantom Dependencies: Revealing the Hidden Software Inside Python Packages
Lecturer
Seth Michael Larson is Security Developer-in-Residence at the Python Software Foundation, a role funded by the OpenSSF Alpha-Omega project. A PSF Fellow, he focuses on supply-chain security for the Python Package Index and the broader ecosystem. His public writing and conference presentations address practical techniques for making Python software measurable and auditable. Personal site: https://sethmlarson.dev.
Abstract
Modern Python packages routinely embed non-Python code—C, C++, Rust, JavaScript, and system libraries—yet conventional manifests such as requirements.txt and the output of pip freeze record only the top-level Python distributions. These “phantom dependencies” remain invisible to most vulnerability scanners and compliance tools. Larson explains the legitimate engineering reasons for their presence, demonstrates how Software Bills of Materials (SBOMs) can surface them, and describes PEP 770, a recently accepted standard that reserves space inside wheels for machine-readable SBOM documents. Practical guidance is offered for generating high-quality manifests and for verifying that scanners actually detect known vulnerabilities across multiple language ecosystems.
The Nature and Origins of Phantom Dependencies
A phantom dependency is any software component that is present and potentially executed yet absent from the project’s declared manifest. The term, popularized by Endor Labs, captures a structural mismatch between the rich, multi-language reality of contemporary packages and the Python-centric metadata that packaging tools historically recorded.
Legitimate motives for embedding foreign code are numerous. Package managers such as pip vendor entire dependency trees in order to bootstrap themselves. Scientific and imaging libraries ship pre-compiled extension modules so that end users need not possess a compiler. The manylinux and musllinux wheel standards further encourage the bundling of shared libraries (via tools such as auditwheel) to guarantee binary compatibility across Linux distributions. Because Python’s packaging metadata cannot express non-Python components, those libraries become invisible to pip freeze, to simple Software Composition Analysis tools, and to many vulnerability scanners.
A concrete illustration is the Pillow imaging library. After installation, a virtual environment contains not only the expected pure-Python and extension modules but also a Pillow.libs directory holding libwebp, libjpeg, and other native libraries. Neither pip freeze nor a naïve file-system inventory performed by Syft reports these libraries, leaving a scanner unable to determine whether a known vulnerability in libwebp is present.
Software Bills of Materials and PEP 770
An SBOM is an ecosystem-agnostic inventory of software components, typically expressed in CycloneDX or SPDX format. Because an SBOM can describe Python packages, native shared objects, Rust crates, and JavaScript modules in a single document, it supplies the missing labels that scanners require. Larson’s PEP 770, accepted in April 2025, formalizes a conventional location—.dist-info/sboms/—inside a wheel where build tools may deposit such documents. Auditwheel, for example, can now emit a CycloneDX SBOM enumerating every library it has bundled; once the wheel is installed, the SBOM appears in the environment and is immediately consumable by Syft, Grype, or similar tools.
Adoption requires almost no change from package maintainers: upgrading the build tool that already performs bundling is usually sufficient. As more build backends and installers begin writing SBOMs, the prevalence of unlabeled phantom dependencies is expected to decline.
Practical Scanning Discipline
Larson advocates a two-stage workflow. First generate a high-quality SBOM from the target environment or container image, then inspect that SBOM manually. Confirm that expected packages appear, that package URLs or CPE identifiers are present, and that no obvious native libraries have been omitted. Only after the manifest is trustworthy should a vulnerability scanner be run against it. Open-source scanners such as Grype and Trivy support multiple ecosystems; pip-audit remains useful solely for pure-Python dependency graphs and should be combined with a multi-language scanner when native code is present.
To validate that vulnerability data actually exist for each ecosystem, a controlled experiment is recommended: edit the SBOM to force an outdated version of a component known to be vulnerable, re-scan, and verify that the expected advisory appears. Absence of the advisory indicates either missing upstream data or an incomplete SBOM—information that is far more valuable than a silent false negative.
Phantom dependencies are not malevolent; they are the inevitable consequence of Python’s role as a glue language and of the practical engineering trade-offs required for portable binary distributions. With the arrival of PEP 770 and the growing availability of SBOM-aware tooling, those dependencies can be made visible, measurable, and therefore manageable. The remaining work is largely one of tooling adoption and of cultivating the habit of treating every deployed environment as a multi-language artifact whose complete inventory must be known before any claim of security can be made.
Links:
[PyConUS2025] Lightning Talks Saturday Evening: Infrastructure Quirks, Community Sustainability, and Reflective Practice
Lecturer
This evening session was facilitated by Christopher Neugebauer and Christian Maureira-Fredes. The speakers comprised Ee Durbin of the Python Software Foundation infrastructure team; Jay Miller representing Black Python Devs; Georgi Ker, co-organizer of PyLadies Con; Anthony Sottile, known for pre-commit and educational content; Molly de Blanc, long-time code-of-conduct practitioner; Anjali Datta, discussing medical imaging; Michael duPont, presenting aviation weather literacy; Marcelo Elizeche Landó, describing low-cost air-quality sensing; Peter Sobot, offering presentation technique; Sophia McKeever, exploring emotional valence in source code; KwonHan Bae of the PSF Board; Mason Egger, examining regular expressions; and Mariatta Wijaya, reflecting on expressions of gratitude within the community. The roster again illustrated the conference’s capacity to surface both technical minutiae and organizational reflection in five-minute increments.
Abstract
The Saturday evening lightning talks traversed conference infrastructure, community funding models, the practical difficulties of global online events, linguistic pedantry, the demographic limitations of codes of conduct, medical imaging, aviation meteorology, citizen sensing, public-speaking craft, the affective dimension of source code, the multiplicative effect of modest donations, the perceptual boundary between regular expressions and noise, and structured practices of appreciation. The collective program balanced technical observation, institutional critique, and interpersonal ethics.
Conference Infrastructure and Community Funding Models
Ee Durbin opened by examining the temporal coordination required by PyCon US itself. The conference website, database, mobile application, Raspberry Pi devices, iPads, and specialized hardware must share a consistent notion of local time. Hard-coded offsets scattered across Python, Django, JavaScript, and mobile code create annual maintenance burden. Durbin proposed the formal definition of a “PyCon US” time zone whose offset equals the local time of the host city and whose annual transition occurs at the departure of the final sprint participant (commonly estimated at 20:00 local time). A prototype zoneinfo definition was submitted to the upstream time-zone coordinators. The talk combined operational necessity with playful formalism, illustrating how conference logistics can generate contributions to foundational Internet infrastructure.
Jay Miller shifted attention to the sustainability of Black Python Devs. Framing the interval of 1.25 years as the organization’s current runway in the absence of new funding, Miller enumerated concrete achievements possible within that window: sponsorship of a dozen events, first-time workshops in under-served Nigerian regions, and leadership summits designed to mitigate organizer burnout. The North American booth at the present conference had itself been executed successfully by a first-time volunteer. Miller invited both financial support via blackpythondevs.com/support and non-monetary contributions of leadership identification, while also directing potential donors toward peer organizations. The presentation converted abstract solidarity into a concrete temporal and fiscal calculus.
Georgi Ker recounted the iterative creation of PyLadies Con. Successive attempts by experienced regional organizers eventually produced a fully online, multilingual, 24-hour event intended to serve the global network of more than 350 PyLadies chapters. Platform migration from Hubilo to Discord, acceptance of talks in any language, and the logistical challenge of continuous coverage across time zones were described with frank acknowledgment of fatigue. Attendance grew from roughly 600 to 700 participants across the first two editions; the 2025 edition (5–7 December) required a fresh fundraising target of 15 000 USD. The talk underscored both the ambition and the recurring resource intensity of global online community events.
Linguistic Precision, Governance Norms, and Domain Applications
Anthony Sottile delivered a brief phonetic intervention. Distinguishing the pronunciations of “pie,” “pi,” and “PyPI,” and anticipating the arrival of Python 3.14 (“pi”), the talk used audience participation to highlight a recurring source of mild confusion within the community. The presentation functioned simultaneously as comedy and as gentle standardization of terminology.
Molly de Blanc offered a set of deliberately contentious observations on codes of conduct. Tracing their institutional history from the early Ubuntu document through the Contributor Covenant, de Blanc noted that the principal authors and early advocates shared a relatively narrow demographic and geographic profile—predominantly North American, coastal, and culturally congruent. Consequently the resulting policies encode a particular value set that may travel imperfectly across legal regimes, linguistic contexts, and political environments hostile to certain protected groups. Supporting transgender community members, for example, can place local organizers in tension with national law. de Blanc argued that change nevertheless remains possible and is already visible in the widening demographic of conference participation, while cautioning against the assumption that a single white-label policy is universally optimal.
Anjali Datta returned to the subject of magnetic-resonance imaging. MRI scanners operating at 1.5–3 Tesla cost approximately one million dollars per tesla yet remain indispensable because they produce soft-tissue contrast without ionizing radiation. Python’s numerical and visualization ecosystem has become integral to reconstruction, analysis, and the emerging generation of AI-assisted diagnostic pipelines. The talk positioned the language as both a practical tool for medical researchers and a point of potential collaboration between the software and clinical communities.
Michael duPont demonstrated how pilots extract operational information from aviation weather products. METARs, TAFs, and related reports encode wind, visibility, cloud layers, and hazards in highly compressed alphanumeric form. Python parsing libraries convert these reports into human-readable summaries or decision-support displays, illustrating another domain in which domain-specific text formats become tractable through modest scripting.
Marcelo Elizeche Landó described AireLib.re, a low-cost air-quality sensor network. Commodity particulate and gas sensors, micro-controllers, and open telemetry stacks enable community-scale monitoring that can complement or challenge official measurements. The project exemplified the citizen-science pattern in which Python mediates between inexpensive hardware and publicly intelligible data products.
Presentation Craft, Affective Code, and Reciprocal Support
Peter Sobot enumerated five practical techniques for retaining audience attention: sustained eye contact and movement, proximity to the microphone, large slide typography (minimum 60-point), preparation of reliable demonstrations (preferably pre-recorded), and rigorous budgeting of every second of stage time. The cumulative cost of even brief distraction, multiplied across hundreds of listeners, was presented as an ethical as well as aesthetic concern.
Sophia McKeever invited the audience to treat source code as an affective artifact. Using an emotion wheel and anonymized snippets produced by a collaborating “poet,” McKeever showed how clean educational examples evoke calm, how unfocused drafts produce apathy, how frustrated authoring yields illegible naming and structure, and how hopeful moments may embed song lyrics or other personal markers. The exercise reframed code review as an encounter with another person’s transient emotional state and suggested that aesthetic and affective literacy belong among a programmer’s skills.
KwonHan Bae employed a single bagel as a concrete metaphor for modest donation. One dollar, aggregated across many donors, funds travel grants, educational outreach, documentation translation, and the eventual emergence of new regional communities and libraries. The circular flow—donation enabling opportunity, opportunity generating later reciprocity—was presented as the slow but reliable mechanism by which the Python Software Foundation and its affiliated projects expand.
Mason Egger staged a participatory game distinguishing valid regular expressions from pure line noise. Progressively more baroque patterns tested the audience’s ability to recognize social-security-number, email, and password-validation idioms, culminating in the observation that certain strings remain syntactically valid only in Perl. The exercise combined technical quiz with gentle satire of the visual density of complex patterns.
Mariatta Wijaya closed the evening with a graduated taxonomy of gratitude. Level zero consists of private thanks; level one of public acknowledgment that amplifies visibility; level two of sustained attention via follows and subscriptions; level three of code or volunteer labor; level four of financial sponsorship; and level five of formal nomination for community awards. Wijaya emphasized that awards do not materialize spontaneously; they require deliberate nomination, and the common assumption that “someone else has already nominated” is frequently false. The talk converted diffuse appreciation into a concrete set of actionable practices.
Across the Saturday evening program, the lightning-talk format again demonstrated its capacity to move rapidly between operational detail, institutional critique, domain science, pedagogical advice, and interpersonal ethics, all within the shared frame of the Python community’s ongoing self-maintenance.
Links:
[PyConUS2025] Python Software Foundation Welcome and Ecosystem Updates
Lecturer
Deb Nicholson is the Executive Director of the Python Software Foundation. She joined the organization in April 2022 after prior roles at the Open Source Initiative (Interim General Manager), Software Freedom Conservancy (Director of Community Operations), and the Open Invention Network. A founding organizer of the Seattle GNU/Linux Conference, she has received the O’Reilly Open Source Award and the Award for the Advancement of Free Software. Nicholson resides in Cambridge, Massachusetts. Her professional profile is available on LinkedIn at https://www.linkedin.com/in/denicholson and on X under the handle @baconandcoconut.
Abstract
This multi-part welcome session presents the current state of the Python Software Foundation, its infrastructure challenges, security initiatives, and community programs, interwoven with short addresses from major sponsors. Deb Nicholson surveys growth metrics for PyPI, the grants program, staffing, and fiscal sponsorships while reflecting on the social strengths and external pressures facing the community. Accompanying remarks from representatives of AWS, Alpha Omega, Meta, and Google highlight collaborative investments in security, tooling, and language evolution.
Security Initiatives and Infrastructure Stewardship
The session opened with brief sponsor remarks. An NVIDIA representative invited attendees to discussions on faster Python and smaller downloads. Hannah Aubrey of AWS Open Source then framed the company’s commitment to long-term security of critical open-source projects, noting that AWS depends on Python’s reliability. Michael Windsor of Alpha Omega described the organization’s four-pronged approach—staffing dedicated security roles, improving package managers, conducting audits, and funding experiments—initiated in response to supply-chain crises such as Log4Shell. He credited Seth Larson and Mike Fiedler for leadership within the Python ecosystem.
Seth Larson, Security Developer in Residence at the PSF, outlined the contemporary threat landscape: vulnerability exploitation, package poisoning, and social-engineering attacks on maintainers. His mandate is to establish secure-by-default experiences for millions of users. He displayed a visualization of social relationships among top PyPI packages, underscoring that security work is distributed across a dense contributor network rather than concentrated in a single office. Larson invited participation in security-focused talks, open spaces, and a meet-the-experts session at the AWS booth later that day.
Ian Barber of Meta, a visionary sponsor, reported that Python is now the most-used language inside the company, with more than three thousand developers. Meta’s investments include Pyfly, an IDE plugin and type-check engine released in alpha for instant autocomplete and navigation on large codebases; free-threaded Python aimed at true multi-threading without the GIL, particularly beneficial for AI workloads; and continued development of Triton and PyTorch, the latter now supporting NVIDIA’s Blackwell architecture and flex attention. Barber directed attendees to the typing summit and the Meta booth.
Deb Nicholson then assumed the podium. She restated the PSF mission: to promote, protect, and advance the Python language and to foster a diverse international community. The Foundation serves as the nonprofit home for both the language and its community, providing infrastructure, security, and legal support while channeling grants and fiscal sponsorships. Python’s ascent to the most-popular language on GitHub was noted with measured pride, accompanied by gratitude to Fastly for a five-year commitment that underpins CDN capacity.
PyPI growth figures illustrated the scale of demand: an 84 percent rise in download counts and 48 percent rise in bandwidth in 2024, following 57 percent and 45 percent increases in the two preceding years. The newly launched PyPI Organizations feature, intended to support collaborative teams and to generate modest administrative revenue for further improvements, attracted 8 500 initial requests—many duplicates or low-quality. Maria Asha cleared the resulting backlog, and the feature is now fully operational under the stewardship of infrastructure lead E.
The grants program has undergone substantial redesign under Community Communications Manager Marie Nordon. Application processes are shorter, more transparent, and more equitable; community updates are regular. Demand has expanded in every dimension—events, amounts, and geographic reach—while revenue has not kept pace, prompting an open invitation for new funding ideas and corporate partnerships.
Community Resilience, Staffing, and Forward Outlook
Nicholson turned to the social character of the Python community, describing its historic openness to “weird kids” and unconventional projects—ranging from analysis of pre-Columbian tooth enamel to experimental tooling. This receptivity, she argued, keeps the language fresh and expands its application domains. Yet she acknowledged the broader context of geopolitical and economic uncertainty that has deterred hundreds of potential international attendees and complicated nonprofit operations. Layoffs, regulatory flux, and funding volatility place additional strain on a small organization whose largest single budget item remains PyCon US itself.
Despite these pressures, the human infrastructure of the PSF remains robust. Nicholson introduced the approximately thirteen staff members who support more than eight million users worldwide. Olivia Sauls directs the conference; Seth Larson and Mike Fiedler manage security reporting and infrastructure; E oversees core systems with assistance from Jacob Coffee; Marie Nordon handles grants, D&I, fellows, and communications; Jamie has transitioned from contractor to full-time events staff; accountants Phyllis and Laura manage fiscal sponsorships, payroll, and compliance; and Lauren has been promoted to Deputy Executive Director with expanded responsibilities for partnerships and strategic planning. Three CPython Developer-in-Residence positions—Lucas, Peter, and Siri—support core development, with Wukush also present for the language summit.
The Board of Directors and a suite of volunteer working groups (code of conduct, diversity and inclusion, education and outreach, fellows, grants, infrastructure, jobs board, packaging, trademarks) extend capacity further. The Foundation acts as fiscal sponsor for twenty projects, most prominently the global PyLadies network. Thousands of additional volunteers worldwide organize local conferences, meetups, and educational programs that sustain Python’s growth.
Sponsor advocacy received special thanks: the individuals inside corporations who repeatedly champion larger contributions and greater conference attendance. Nicholson closed by urging the community to “stay weird and keep welcoming all the nice weirdos,” then introduced Lisa of Google. Lisa, attending her first PyCon, praised the energy and the dedicated newcomers’ session. She reaffirmed Google’s reliance on Python across scripting, DevOps, and machine learning, and expressed particular interest in free-threaded Python, typing-standard evolution, and performance work. Multiple Google colleagues were present for the typing summit, a talk on programming for oneself, and a supply-chain security open space.
Collectively the addresses portray a Foundation that has scaled its technical and social infrastructure in step with extraordinary adoption while remaining attentive to inclusion, security, and long-term sustainability. The interplay of staff, volunteers, sponsors, and core developers illustrated in the session constitutes the operational backbone that enables the language’s continued vitality.
Links:
[PyConUS2025] Welcome Address by the Conference Chair
Lecturer
Elaine Wong serves as the Conference Chair for PyCon US 2025. A long-standing contributor to the Python community, she previously chaired PyCon Canada in 2018 and co-chaired it in 2019. Wong has organized PyLadies Toronto and the CSV Conference, supported video production at multiple community events, and co-hosts a monthly virtual meetup for conference organizers. Recognized with a Python Software Foundation Community Service Award in 2020 and designated a PSF Fellow, she brings extensive experience in community building, livestreaming, and event logistics. Her professional background includes media and broadcasting work. Further details appear on her personal website at https://eswong.ca/ and her presence on X under the handle @elthenerd.
Abstract
This address opens PyCon US 2025 in Pittsburgh, Pennsylvania, by outlining the logistical framework, community resources, and programmatic highlights of the multi-day gathering. Elaine Wong introduces the organizing team, sponsors, and volunteers while providing essential orientation on venue navigation, code of conduct, accessibility measures, and special tracks. The presentation emphasizes participatory opportunities such as open spaces, hatcheries, and lightning talks, situating the conference within the broader ethos of inclusive Python community practice.
Conference Orientation and Community Infrastructure
Elaine Wong began by expressing enthusiasm for the assembled attendees and offering a light-hearted musical greeting adapted to the occasion. She introduced herself as Conference Chair and acknowledged her co-chair, John, who stood ready to assist with questions throughout the event. Together they form the primary points of contact for logistical support and guidance.
Central to the success of the conference, Wong stressed, is the dedicated staff of the Python Software Foundation. She listed Olivia, Deb, Lauren, Jamie, Phyllis, Laura, E, Marie, Jacob, Maria, Seth, and Mike, inviting a round of applause for their year-long efforts in preparing the venue, program, and infrastructure. Equally vital are the sponsors whose financial contributions underwrite food service, utilities, and overall operations; attendees were encouraged to visit the expo hall and express personal thanks via a provided QR code linking to the full sponsor roster.
The volunteer cohort received particular recognition. More than one hundred individuals had already signed up, with a target of three hundred on-site volunteer hours. Wong directed participants to a QR code and website for short-term shifts ranging from one to several hours, noting that such engagement offers both practical insight into conference operations and an eventual pathway toward leadership roles such as chair.
Practical orientation followed. Wi-Fi credentials and a QR code for network access were displayed, alongside announcement of a new mobile application available for both iOS and Android platforms. The application supplies schedules, maps, and session favoriting capabilities. Venue layout received detailed treatment: general sessions, keynotes, lightning talks, and special guest presentations occupy Hall B on the second floor. Parallel talk tracks are located in Hall C and on the third floor, reachable via escalators or elevators and a pedestrian walkway. Breakfast is served outside Hall B beginning at 7:30 each morning; lunch and snacks appear in Hall A, which also houses the expo hall on Friday and Saturday as well as swag pickup for pre-ordered t-shirts. Surplus shirts become available for purchase on Sunday at 11:00 on a first-come basis. Luggage storage operates Saturday and Sunday outside Show Office C from 8:00 to 18:00, with later retrieval possible from the staff office in rooms 306–307. A mothering and nursing room occupies Show Office B; the travel-grant office is in Show Office A, with posted hours for recipients. Gender-neutral restrooms are clearly marked. The fourth floor hosts summits and the PyLadies lunch, while room 405 provides a quiet space and a rooftop terrace offers outdoor respite. Emergency procedures direct participants to call 911 and notify staff wearing light-blue shirts or DLCC attire; on-site EMTs are stationed behind Hall B on the main conference days.
Code-of-conduct provisions received careful attention. Wong summarized the expected standard of conduct by reference to the kindness and consideration associated with Mr. Rogers. Concerns may be reported by text, email, or in person to the committee led by Molly, whose members wear distinctive orange shirts and maintain a presence in the staff room. Photo policy is signaled by lanyard color: orange indicates preference against photography, black indicates consent. Health and safety guidance encourages but does not require masking; free masks and testing kits remain available at registration.
A brief recap of the preceding two days noted completed tutorials, the language summit, education summit, WebAssembly summit, sponsored presentations, newcomers’ orientation, and a lively opening reception. Keynote speakers Jeff, Tom, Lynn, Corey, and Dr. Corey Jordan were introduced, with the added note that all would hold meet-and-greet sessions at the PSF booth; the Carpentries, led by Dr. Jordan, maintain an expo presence. Special programming includes a diversity-and-inclusion panel, a security-engineer update, and a Python Steering Council session. The Charlas Spanish-language track occupies rooms 310 and 311 for two days, inviting participants of every proficiency level. Live human captioning, provided by White Coat Captioning, accompanies all talks.
Hatchery events expand the formal program: FlaskCon occupies the afternoon of the current day, a community-organizer summit and Hometown Heroes showcase occur on Saturday, and a beginner-oriented Humble Data workshop runs on Sunday, all centered in room 317. Additional summits address typing, maintainership, packaging, and mentor sprints. Open spaces have been digitized; participants register via website or QR code for one-hour self-organized sessions on a first-come basis. Lightning-talk sign-ups likewise proceed through an online form linked to each attendee’s dashboard, with four scheduled rounds. Tickets remain available for the PyLadies auction, a dinner-and-bidding event that constitutes the principal fundraiser for the PyLadies Foundation and supports both global chapters and travel grants. The PyLadies luncheon on Sunday offers further reflection and networking. Sunday also features posters, a job fair, and a community showcase that invites regional conferences, meetups, and open-source projects to claim tables.
Local recommendations for Pittsburgh attractions, including the baseball stadium and neighborhood eateries, appear under a provided URL. Wong closed by endorsing the informal “hallway track” and the Pac-Man rule—leaving physical space in conversational circles so that newcomers may join readily. Official social-media channels and the hashtag #PyConUS complete the orientation.
Programmatic Opportunities and Inclusive Practices
Beyond logistics, the address situates PyCon US within a deliberately inclusive framework. The multi-track structure, language accessibility via Charlas and live captioning, quiet rooms, gender-neutral facilities, and explicit photo and health policies collectively lower barriers to participation. Hatcheries and open spaces democratize content creation, allowing attendees to surface emerging ideas outside the formal call-for-proposals process. Lightning talks lower the threshold for first-time speakers. Volunteer pathways and the explicit invitation to future leadership roles reinforce the conference’s self-renewing character. Financial underwriting by sponsors and the travel-grant system further extend reach. Collectively these measures illustrate how a large-scale technical gathering can embed community values of accessibility, mutual support, and continuous expansion of the Python ecosystem.