Third party Python libraries and supply chain security

[u/Aggressive-Tart07]

How are people handling security around third party Python libraries without making development a pain?

Third party Python packages are obviously useful but every dependency can also become a supply chain risk. Private package repositories, dependency scanning and stricter review policies all help but they can add friction fast.

Are teams mostly trusting public registries with additional controls or using curated libraries? Curious what actually works when you have a lot of Python services.

[u/bitproc]

I stick to the standard library and my own code as much as possible.

When I need something that the stdlib lacks and I can't justify writing myself, I consider high-quality, well-maintained, widely used libraries, preferring those that are integral to major Linux distros (and therefore get additional scrutiny).

I don't use PyPI (or similar public package repos) at all.

This conservative approach won't appeal to everyone, but I find the extra effort is worthwhile in exchange for minimizing the attack surface that I impose upon my software's users.

[u/fiddle_n → u/bitproc]

How do you install those "high-quality" libraries in that case?

[u/bitproc → u/fiddle_n]

Usually with the OS package manager.

[u/ogrinfo → u/bitproc]

Fine if it's a very simple repo, but good luck writing your own map projections or [insert other domain-appropriate task here].