Sovereign Tech Agency Invests €86,000 in Python Software Foundation Security Initiatives
The German Sovereign Tech Agency has committed an €86,000 investment to the Python Software Foundation (PSF) to enhance the security of CPython and the Python Package Index (PyPI). This funding supports two parallel projects aimed at strengthening critical open-source infrastructure. The first component, led by Seth Larson, addresses archive-handling vulnerabilities in CPython’s standard library, specifically targeting the tarfile and zipfile modules. It involves developing test cases, integrating fuzz-testing via OSS-Fuzz, and validating extraction filtering protections against potential bypasses. The second component, led by Mike Fiedler with support from Ee Durbin, focuses on improving PyPI account integrity and recovery mechanisms. This initiative introduces OAuth 2.0 and OIDC flows to associate accounts with verified third-party identities, reducing reliance on email-based recovery and enhancing platform reliability. These improvements aim to secure the software supply chain for millions of users globally, reflecting the Sovereign Tech Agency’s mission to bolster the resilience of essential digital technologies through strategic global investments in open-source components.
Wire timeline
Sovereign Tech Agency Invests €86,000 in Python Software Foundation Security Initiatives
The German Sovereign Tech Agency has committed an €86,000 investment to the Python Software Foundation (PSF) to enhance the security of CPython and the Python Package Index (PyPI). This funding supports two parallel projects aimed at strengthening critical open-source infrastructure. The first component, led by Seth Larson, addresses archive-handling vulnerabilities in CPython’s standard library, specifically targeting the tarfile and zipfile modules. It involves developing test cases, integrating fuzz-testing via OSS-Fuzz, and validating extraction filtering protections against potential bypasses. The second component, led by Mike Fiedler with support from Ee Durbin, focuses on improving PyPI account integrity and recovery mechanisms. This initiative introduces OAuth 2.0 and OIDC flows to associate accounts with verified third-party identities, reducing reliance on email-based recovery and enhancing platform reliability. These improvements aim to secure the software supply chain for millions of users globally, reflecting the Sovereign Tech Agency’s mission to bolster the resilience of essential digital technologies through strategic global investments in open-source components.
Python Software Foundation News