PyPI now supports digital attestations

After 2FA, the previous PyPI buzzword that was forced on everyone, JFrog discovered a key leak that compromised everything:

https://news.ycombinator.com/item?id=40941809

JFrog also discovered multiple malicious package exploits later.

Now we get a Github centric new buzzword that could be replaced by trusted SHA256 sums. Python is also big on business speak like SBOM. The above key leak of course occurred after all these new security "experts" manifested themselves out of nowhere.

The procedure remains the same. Download a package from the original creators, audit it, use a local repo and block PyPI.

After reading the underlying report (https://jfrog.com/blog/leaked-pypi-secret-token-revealed-in-...), I can't help but think: "where is the defense in depth?" Since `.pyc` files are just a cache of compilation that's already generally pretty quick, this could have been prevented by systems that simply didn't allow for pushing them into the Docker image in the first place. Or by having `PYTHONDONTWRITEBYTECODE=1` set on the developer's machine.

(Also, now I'm trying to wrap my head around the fact that there's such a thing as "Docker Hub" in the first place, and that people feel comfortable using it.)