TECH Signal 397
PyPI reproducible builds blocked by missing source metadata, sdist SBOM support, and verifier infrastructure
↗
Python packaging lacks the specifications for reproducible builds on PyPI, specifically source code location recording in distributions, SBOM support for sdists, and a mechanism for trusted third parties to surface verified reproductions.
Without reproducible builds, no independent party can verify that a PyPI distribution matches its source code, leaving the supply chain vulnerable to build-process tampering like the SolarWinds compromise. Even pure Python wheels carry this risk if their build backend is compromised.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Source code locations are not recorded in sdists or wheels, though direct_url.json already captures this for direct installs from repositories or archives.
Wheels support SBOMs via PEP 770, but sdists lack any mechanism for recording build tools because their format is just a tarball with PKG-INFO.
Trusted verifiers could report successful reproductions to PyPI, and the index API could let installers prefer reproduced distributions.
THE CLUSTER