"The perfect setup? Not setup.py! Building packages the right way"
summary
Argues to stop using setup.py with concrete malware examples showing arbitrary code execution during install and surprising vectors like registry changes and downloaded EXEs, documents how to declare builds in pyproject.toml and use alternative build backends (Flit, Hatch, Poetry, setuptools), shows migration patterns reaching ~50% adoption this year, demonstrates how dynamic fields and hooks can still execute code, and gives step‑by‑step fixes plus practical security checks to adopt safely.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 1:16Understanding setup.py
- 1:51Why setup.py is problematic
- 6:56The history of packaging
- 10:36The shift to pyproject.toml
- 14:09How to migrate to the new way
- 19:02Malicious code execution hacks
- 24:22Best practices and homework
- 26:19Conclusion and Q&A
related talks
25mInside the Cheeseshop: How Python Packaging Works
22mPublishing well formed Python packages
45mStarting your project right: setup and automation for all
02h 36mPython Packaging Demystified
28mModern Python packaging without pain
25m"Security considerations in Python Packaging"
51mTaking Python beyond scripting
36mLess known packaging features and tricks