EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 16·5 min read
What's missing to have reproducible builds on PyPI
TL;DR
Reproducible builds in Python packaging are essential for secure supply chains, allowing verification of code integrity. Implementing this requires recording source code and build tools used in distributions.
✦ Why It Matters
Start recording source code and build tools in your Python packages to enhance security today.
Key Takeaways
- Advocate for recording source code in Python package metadata.
- Support the development of SBOMs for sdists to enhance reproducibility.
- Encourage trusted verifiers to confirm package integrity.
- Promote awareness of security risks in the Python packaging ecosystem.
How It Works
Reproducible builds require recording the source code and tools used in the build process. By including this information in package metadata, developers can verify that the distributed software matches the original source, thus ensuring integrity.