My nomination statement for the 2026 Python packaging council
I have decided to run for the inaugural/2026 Python packaging council (PPC). I will say I have the support of my employer (Microsoft) to do this, but they didn't ask
How to publish to PyPI using GitHub Actions securely
There have been several security incidents lately that involved compromising GitHub Actions workflows. This has led some to say "GitHub Actions is the weakest link" in publishing and to GitHub publishing
Why I wrote PEP 832 -- virtual environment discovery
While I decide what to do with PEP 832 after polling folks on their opinion, I thought I would write out why I'm even bothering with any of this.
I'
Why pylock.toml includes digital attestations
A Python project got hacked where malicious releases were directly uploaded to PyPI. I said on Mastodon that had the project used trusted publishing with digital attestations, then people using a pylock.toml
State of WASI support for CPython: March 2026
It's been a while since I posted about WASI support in CPython! 😅 Up until now, most of the work I have been doing around WASI has been making its maintenance easier