WEBVTT 00:00:00.020 --> 00:00:04.020 Hello and welcome to Python Bytes, where we deliver Python news and headlines directly 00:00:04.390 --> 00:00:04.860 to your earbuds. 00:00:05.240 --> 00:00:07.020 This is episode 504, 00:00:07.180 --> 00:00:08.800 recorded Monday, 00:00:09.420 --> 00:00:10.040 November 9th, 00:00:10.420 --> 00:00:10.740 2026. 00:00:10.920 --> 00:00:11.460 I'm Michael Kennedy. 00:00:11.780 --> 00:00:12.900 And I'm Calvin Hendrix-Parker. 00:00:13.130 --> 00:00:15.900 And this episode is brought to you by Longlink. 00:00:16.139 --> 00:00:18.920 They're a really awesome platform for building 00:00:19.280 --> 00:00:23.360 business applications on top of things like FastAPI and Python. 00:00:23.530 --> 00:00:24.640 So I'm really excited to 00:00:24.520 --> 00:00:25.740 tell you more about them later. 00:00:26.240 --> 00:00:26.800 Connect with us, 00:00:27.360 --> 00:00:28.160 Mastodon, Bluesky, 00:00:28.740 --> 00:00:28.820 X, 00:00:29.060 --> 00:00:29.220 LinkedIn, 00:00:29.510 --> 00:00:29.980 all the things, 00:00:30.050 --> 00:00:30.900 all that stuff's at the top. 00:00:31.360 --> 00:00:33.080 And we've got this great newsletter, 00:00:33.340 --> 00:00:34.620 really fun stuff that we share 00:00:34.670 --> 00:00:37.880 with people every week, almost every week, almost every week, 00:00:38.340 --> 00:00:40.540 and sign up for it and you'll get it 00:00:40.620 --> 00:00:41.620 as well. You'll enjoy it, I'm sure. 00:00:42.020 --> 00:00:43.400 So with that, 00:00:44.340 --> 00:00:46.060 feeling like some things could use, I don't know, 00:00:46.090 --> 00:00:47.360 some redesigns. What do you think? 00:00:47.520 --> 00:00:51.020 How about a new view on life? A new view on life. Okay. 00:00:51.080 --> 00:00:51.180 Yeah, 00:00:51.650 --> 00:00:53.640 how about a new view for PyPI? 00:00:54.040 --> 00:00:55.120 Oh, I'm here for that, 00:00:55.320 --> 00:00:55.880 yes, let's do it. 00:00:55.940 --> 00:00:56.320 I am too. 00:00:57.140 --> 00:00:59.320 That's kind of critical to a lot of things we do. 00:00:59.840 --> 00:01:03.200 So PyPI has redesigned the project pages, 00:01:04.140 --> 00:01:06.320 which is pretty nice because it now warns 00:01:06.420 --> 00:01:07.540 when there's provenance changes. 00:01:08.110 --> 00:01:08.900 So LiveNow, 00:01:09.370 --> 00:01:10.600 I think as of like three days ago, 00:01:11.040 --> 00:01:11.820 at least they announced it, 00:01:12.650 --> 00:01:14.660 that they were basically doing some user research 00:01:14.840 --> 00:01:15.700 that they talked about in July. 00:01:16.340 --> 00:01:19.120 This was funded by OpenSSF 00:01:19.140 --> 00:01:21.380 and built by the Kabu Creative, 00:01:21.980 --> 00:01:24.700 there is a new security tab on every project page, 00:01:25.080 --> 00:01:26.200 which is gonna show the releases, 00:01:27.020 --> 00:01:30.340 provenance state and per file attestations. 00:01:30.680 --> 00:01:32.140 So actually I'll scroll down and through here. 00:01:32.620 --> 00:01:33.780 There's this new security tab. 00:01:33.780 --> 00:01:35.820 So if you go to PyPI today 00:01:36.480 --> 00:01:37.800 and look at any project that's up there, 00:01:37.920 --> 00:01:39.900 you'll see a new security tab. 00:01:40.780 --> 00:01:43.900 I think you'll see a sense of some of the theme 00:01:44.160 --> 00:01:48.280 of my updates lately have been very much supply chain 00:01:48.300 --> 00:01:50.760 and attack vector related. 00:01:50.900 --> 00:01:52.780 And so this is in response to a lot of that as well. 00:01:53.720 --> 00:01:55.960 You get basically two attestation types. 00:01:56.060 --> 00:01:59.040 There is the on the PyPI publish one, 00:01:59.180 --> 00:02:01.560 which is basically uploaded by a trusted publisher. 00:02:01.780 --> 00:02:03.200 So there's a trusted publisher plan 00:02:03.340 --> 00:02:05.740 or program that you can sign up for. 00:02:06.080 --> 00:02:09.780 And then there is the SLSA build provenance, 00:02:09.880 --> 00:02:11.480 which ties into a files commit, 00:02:11.800 --> 00:02:13.760 the build platform and the instructions. 00:02:14.040 --> 00:02:15.960 So there's two different kinds of provenance 00:02:16.500 --> 00:02:17.000 that's up there. 00:02:17.480 --> 00:02:18.060 So you can see here, 00:02:18.220 --> 00:02:20.440 there's the PI PI trusted publisher 00:02:21.200 --> 00:02:21.800 at the station. 00:02:22.660 --> 00:02:24.760 You're gonna see this for any project that has done 00:02:24.980 --> 00:02:26.660 any of the digital attestations to date. 00:02:26.860 --> 00:02:30.500 So projects like, for example, I pulled up SQLAlchemy. 00:02:30.920 --> 00:02:33.340 SQLAlchemy has a security tab now, 00:02:33.840 --> 00:02:34.360 well, all of them do. 00:02:34.740 --> 00:02:37.160 And you'll see that the last 72 files in this release 00:02:37.210 --> 00:02:39.280 have been uploaded with Providence metadata. 00:02:39.680 --> 00:02:42.540 So all these releases here have that metadata. 00:02:43.220 --> 00:02:46.279 So obviously the crew over there on SQLAlchemy 00:02:46.300 --> 00:02:50.580 ahead of the game and we're publishing these before they were really visible to end users. 00:02:50.670 --> 00:02:56.660 So this solves that problem of making these attestations visible to folks in the community. 00:02:57.120 --> 00:03:03.560 There's also the SLSA style. So you'll see this orange icons which give you the identity, 00:03:03.980 --> 00:03:04.360 the build, 00:03:04.660 --> 00:03:05.200 the commit, 00:03:05.840 --> 00:03:06.780 the hash, 00:03:07.230 --> 00:03:09.879 and all the pieces that basically tie this directly back into 00:03:10.560 --> 00:03:11.400 the CI pipeline. 00:03:11.900 --> 00:03:16.100 There's also in addition to the there's warnings now you'll see. 00:03:16.500 --> 00:03:17.020 So there's like 00:03:17.100 --> 00:03:22.300 a no providence is not necessarily a malware flag. It just means that the file's origins couldn't be 00:03:22.440 --> 00:03:23.460 cryptographically verified. 00:03:24.240 --> 00:03:26.860 That's typical for older releases and things not using trusted 00:03:27.020 --> 00:03:30.060 publishing. So don't take that as a necessarily a bad sign. 00:03:30.480 --> 00:03:33.300 But there are four new providence warnings 00:03:33.920 --> 00:03:35.020 down here for incomplete, 00:03:35.420 --> 00:03:36.280 inconsistent, 00:03:36.900 --> 00:03:39.120 and change or loss of providence. 00:03:39.600 --> 00:03:40.420 And those are all described 00:03:40.440 --> 00:03:42.180 here in that release specifically. 00:03:42.860 --> 00:03:45.840 But you'll see here now you'll get a warning at the top of that 00:03:46.740 --> 00:03:50.140 PyPI product page for incomplete providence, for example, 00:03:50.340 --> 00:03:51.520 with an explanation. Like, for example, 00:03:51.620 --> 00:03:55.080 two of the five files were uploaded without the providence metadata, 00:03:55.660 --> 00:03:56.920 which could be signals that 00:03:56.920 --> 00:03:59.020 you may encounter a supply chain attack. 00:03:59.260 --> 00:04:01.860 But I don't think it should be the end-all be-all 00:04:03.240 --> 00:04:06.960 definitive answer. You have to obviously go do your own search on that. 00:04:07.320 --> 00:04:08.500 These are meant to catch 00:04:08.520 --> 00:04:10.900 files that may not have come from maintainers, 00:04:11.140 --> 00:04:13.400 such as after an account or publishing workflow 00:04:13.760 --> 00:04:14.060 takeover. 00:04:14.360 --> 00:04:19.400 PyPI says a change of providence can also indicate a compromised pipeline or the account 00:04:19.519 --> 00:04:25.360 takeover or an unexpected loss of providence should be treated with skepticism until verified. 00:04:25.840 --> 00:04:29.760 And so I think that's the state of most security folks who are in the community, 00:04:31.340 --> 00:04:33.020 treat everything with skepticism until verified. 00:04:33.460 --> 00:04:35.720 The warnings will sit on top of the page until 00:04:35.940 --> 00:04:37.280 it is yanked, for example, 00:04:37.580 --> 00:04:39.120 archived or with pre-release banners, 00:04:39.700 --> 00:04:41.000 the quarantine banner 00:04:41.280 --> 00:04:44.180 overrides all of them. So that's kind of the top one you'll see on there. 00:04:44.680 --> 00:04:45.940 You also notice that the 00:04:46.060 --> 00:04:50.700 redesigned product detail page has some new niceties other than the providence bit. 00:04:51.040 --> 00:04:51.600 But probably the 00:04:51.600 --> 00:04:57.200 more interesting one is the file release files and release history will now clearly state or clearly 00:04:57.380 --> 00:05:00.800 show when there's things that are pre-release or release that has been yanked. 00:05:01.180 --> 00:05:01.820 That's always a big 00:05:01.960 --> 00:05:05.700 question for me when I'm looking at like trying to figure out why maybe a build failed or why I 00:05:05.720 --> 00:05:06.080 find something. 00:05:06.620 --> 00:05:08.680 So now you can actually see that there's a yanked reason, 00:05:09.400 --> 00:05:10.400 you know, set up blunder, 00:05:10.700 --> 00:05:12.860 breaking some bind gen code paths, for example, 00:05:13.040 --> 00:05:14.560 in the one that's in their blog post. 00:05:14.920 --> 00:05:15.240 But I think 00:05:15.300 --> 00:05:20.880 this is really great to highlight or bring to the, you know, the top of the stack when there's 00:05:21.260 --> 00:05:23.280 potential problems with the dependency packages in there. 00:05:23.640 --> 00:05:24.680 Mike, what do you think of the redesign? 00:05:25.040 --> 00:05:25.620 I like it. 00:05:25.800 --> 00:05:26.180 I mean, 00:05:26.540 --> 00:05:27.360 it's pretty familiar. 00:05:27.640 --> 00:05:28.640 There's not a whole lot of change, 00:05:28.820 --> 00:05:29.360 but functionally, 00:05:29.820 --> 00:05:31.900 I think it's a very important change, 00:05:32.220 --> 00:05:33.900 right? I think we've had trusted publishing, 00:05:34.340 --> 00:05:34.480 but. 00:05:34.820 --> 00:05:36.020 It just wasn't very visible. 00:05:36.340 --> 00:05:37.980 Like you had to kind of know this, 00:05:38.000 --> 00:05:42.200 this puts it a little more into the direct line of sight for everyday users 00:05:42.620 --> 00:05:44.020 or everyday developers who are, 00:05:44.400 --> 00:05:44.560 you know, 00:05:44.980 --> 00:05:46.320 maybe not as critical as they should be. 00:05:46.600 --> 00:05:46.800 Yeah. 00:05:47.100 --> 00:05:48.880 Scroll into the partial provenance, 00:05:49.280 --> 00:05:50.820 the one with the reddish orange bar. 00:05:50.960 --> 00:05:51.180 Yeah. 00:05:51.320 --> 00:05:51.380 Yeah. 00:05:51.420 --> 00:05:51.840 Here we go. 00:05:52.800 --> 00:05:53.360 There you go. 00:05:53.700 --> 00:05:53.940 This one. 00:05:54.160 --> 00:05:58.920 As a person who did Python stuff on the web back in the day, 00:05:59.320 --> 00:06:01.740 how about that pyramid debug toolbar in the screenshot? 00:06:01.980 --> 00:06:02.340 Come on now. 00:06:03.720 --> 00:06:05.000 That was a good catch. 00:06:05.510 --> 00:06:07.140 Right over here at the Pyramid Debug Bar. 00:06:07.620 --> 00:06:07.980 Yeah. 00:06:08.420 --> 00:06:10.160 Clicking it will do nothing because it's an image, but still. 00:06:10.540 --> 00:06:10.820 Right. 00:06:12.360 --> 00:06:16.260 Obviously, they made the screenshots from a pre-release version of Warehouse. 00:06:16.700 --> 00:06:17.240 Yeah, that's cool. 00:06:17.390 --> 00:06:18.260 I don't know if this is out. 00:06:18.300 --> 00:06:18.840 Is this out yet? 00:06:18.950 --> 00:06:19.280 Do you know? 00:06:19.440 --> 00:06:19.840 This is out. 00:06:20.020 --> 00:06:20.600 This is live. 00:06:22.560 --> 00:06:24.800 The screen I showed from SQLAlchemy was real. 00:06:25.240 --> 00:06:29.640 I went through and had to search a couple of projects before I found one that had full 00:06:29.940 --> 00:06:31.860 provenance or were using the digital attestations. 00:06:32.340 --> 00:06:34.000 A lot of common projects aren't yet. 00:06:34.100 --> 00:06:35.320 So for example, I searched for Django. 00:06:35.960 --> 00:06:36.440 It was not, 00:06:36.600 --> 00:06:39.020 the Django project's not currently using digital adaptations, 00:06:39.980 --> 00:06:40.620 but boy, it should. 00:06:41.060 --> 00:06:43.580 And hopefully this highlights that for package maintainers. 00:06:44.050 --> 00:06:45.180 So they start doing this. 00:06:45.580 --> 00:06:46.860 Yeah, it makes a lot of sense. 00:06:47.160 --> 00:06:50.560 And you're making me realize I should probably do it for one of my projects I'm just about to talk about. 00:06:50.650 --> 00:06:51.400 So let's talk about it. 00:06:51.780 --> 00:06:52.660 All right, Michael, get on it. 00:06:53.260 --> 00:06:53.600 So I, 00:06:54.200 --> 00:06:54.720 was it last week, 00:06:54.960 --> 00:06:57.620 week before I introduced my chameleon-rs. 00:06:57.690 --> 00:06:58.760 I think that was two weeks ago. 00:06:59.060 --> 00:06:59.260 project, 00:06:59.780 --> 00:07:01.700 which is the chameleon, speaking of pyramid, 00:07:02.160 --> 00:07:04.180 the chameleon template language rebuilt 00:07:04.320 --> 00:07:07.040 for free threading and faster in Rust, 00:07:07.580 --> 00:07:08.460 all these kinds of things, right? 00:07:08.820 --> 00:07:09.580 And that is, 00:07:09.860 --> 00:07:10.320 maybe I hinted 00:07:10.320 --> 00:07:16.600 at this. This is just, that was just the first deposit in a bigger goal that I have to make free 00:07:16.720 --> 00:07:17.800 threading better for Python. 00:07:18.320 --> 00:07:18.760 And I've, 00:07:19.140 --> 00:07:20.100 it's been out for two years, 00:07:20.640 --> 00:07:21.560 two years. 00:07:21.900 --> 00:07:22.640 How many projects 00:07:22.980 --> 00:07:23.360 support it? 00:07:23.700 --> 00:07:24.600 Almost none. It's really, 00:07:24.960 --> 00:07:26.960 I think, honestly, it's a little bit disheartening for me. 00:07:27.020 --> 00:07:29.100 I don't know how you feel about this, but I'm sitting here with, 00:07:29.340 --> 00:07:30.560 you know, 18 cores on my 00:07:30.680 --> 00:07:30.760 machine. 00:07:31.400 --> 00:07:34.060 I get like 5% use out of them on my projects. 00:07:34.400 --> 00:07:35.060 And it's just like, 00:07:35.340 --> 00:07:36.340 I get it. It's new 00:07:36.780 --> 00:07:37.260 last year. 00:07:37.680 --> 00:07:38.380 You know what I mean? 00:07:38.540 --> 00:07:38.720 Right. 00:07:38.920 --> 00:07:41.600 But it's like, okay, we're, we're into the third release, 00:07:42.020 --> 00:07:44.400 third yearly release of Python with free threading. 00:07:44.720 --> 00:07:45.420 And I don't know, 00:07:45.820 --> 00:07:47.940 maybe I was either inspired or 00:07:48.040 --> 00:07:50.700 grumpy. I don't know which way you want to perceive it, but I'm just like, that's it. 00:07:50.700 --> 00:07:51.040 I don't know, Michael, 00:07:51.240 --> 00:07:51.700 what's your hurry? 00:07:52.960 --> 00:07:53.380 Come on. 00:07:53.680 --> 00:07:54.340 Can't you be a little patient? 00:07:54.800 --> 00:07:55.340 I'm like, okay. 00:07:56.620 --> 00:08:00.760 A lot of these projects, I'm like, oh, well, if I could like kind of poke at the edge, maybe this little thing that'll make a little better. 00:08:00.840 --> 00:08:01.400 I'm like, you know what? 00:08:01.740 --> 00:08:09.040 Maybe if it's not going to get moved forward, maybe I can make an alternative version that's somehow API compatible or API similar or just not at all, 00:08:09.380 --> 00:08:10.380 but kind of moves that forward. 00:08:10.460 --> 00:08:13.720 And so the Chameleon-RS one was the first one. 00:08:13.740 --> 00:08:15.720 And that's like full free threading support. 00:08:16.080 --> 00:08:17.480 I'm working on some others I'll talk about. 00:08:17.980 --> 00:08:20.340 But one of the things I had Chris Ariza, 00:08:20.500 --> 00:08:22.060 Christopher Ariza on Talk Python. 00:08:22.720 --> 00:08:23.320 It's not out yet, 00:08:23.500 --> 00:08:24.580 but he has recorded the episode. 00:08:24.980 --> 00:08:25.900 It'll be out in two weeks. 00:08:26.360 --> 00:08:26.380 Yeah. 00:08:26.740 --> 00:08:29.980 And we talked about free threading. And one of the things, I don't know, let me know if you 00:08:30.060 --> 00:08:33.400 know this, because I did not know this. This totally surprised me. If I get Python, 00:08:34.320 --> 00:08:34.719 free threaded 00:08:34.969 --> 00:08:35.099 Python, 00:08:35.560 --> 00:08:37.640 it's not that the GIL is not there. 00:08:37.950 --> 00:08:39.120 The GIL is still there. 00:08:39.280 --> 00:08:40.719 It's just a feature flag 00:08:41.120 --> 00:08:41.620 turned off, 00:08:42.240 --> 00:08:43.460 even in the Python T, 00:08:44.010 --> 00:08:44.159 right? 00:08:44.580 --> 00:08:46.680 And here's where this gets kind of crazy. 00:08:47.160 --> 00:08:47.820 If you import 00:08:47.960 --> 00:08:49.340 something that does not, 00:08:49.800 --> 00:08:51.740 that has native extensions, 00:08:52.140 --> 00:08:53.180 I think this is not sufficient, 00:08:53.420 --> 00:08:53.639 but 00:08:53.880 --> 00:08:56.300 native extensions, like a C extension sort of thing. 00:08:56.580 --> 00:08:59.540 If it does not explicitly say that it is thread safe, 00:08:59.960 --> 00:09:01.960 the gil gets turned back on for the whole process permanently. 00:09:02.420 --> 00:09:02.600 That's it. 00:09:03.380 --> 00:09:03.700 Like what? 00:09:04.120 --> 00:09:05.400 I thought we had free threaded Python. 00:09:05.560 --> 00:09:05.660 Like, 00:09:05.880 --> 00:09:06.000 no, 00:09:06.540 --> 00:09:08.440 you get the possibility of maybe, 00:09:09.200 --> 00:09:11.460 and then eventually it could potentially turn itself back off. 00:09:11.720 --> 00:09:12.420 I'm like, all right, 00:09:13.000 --> 00:09:15.000 that is just nuts. 00:09:15.400 --> 00:09:17.720 So what I would like is some kind of library 00:09:17.920 --> 00:09:20.460 or some kind of indicator that this is a problem 00:09:20.580 --> 00:09:21.640 and it is turned back on. 00:09:21.960 --> 00:09:26.080 Because if I have something like eight threads working on something and I have eight cores 00:09:26.280 --> 00:09:26.540 on it, 00:09:26.880 --> 00:09:27.400 that's fine. 00:09:27.880 --> 00:09:31.640 But if it turns out that it gets turned back into a single thing with the gill, 00:09:32.000 --> 00:09:32.640 the collapse 00:09:32.720 --> 00:09:34.960 of performance, it doesn't just fall back to single threaded. 00:09:35.340 --> 00:09:36.400 It falls below, 00:09:37.120 --> 00:09:40.300 like possibly quite a bit below the performance you would have got if 00:09:40.300 --> 00:09:41.060 you just used one thread, 00:09:41.440 --> 00:09:41.560 right? 00:09:41.720 --> 00:09:42.560 Because there's just contention, 00:09:42.900 --> 00:09:45.740 all this contention and sharing and locking over still 00:09:45.920 --> 00:09:46.500 computed in parallel, 00:09:46.680 --> 00:09:46.780 right? 00:09:47.040 --> 00:09:47.380 All that. 00:09:47.700 --> 00:09:50.920 So I'm introducing to the world my next release, 00:09:51.040 --> 00:09:52.200 and there will be more, like I said, 00:09:52.740 --> 00:09:53.860 called Gilguard, 00:09:54.260 --> 00:09:55.020 the Gilguard. 00:09:55.460 --> 00:09:56.640 And here's what the Gilguard does. 00:09:56.860 --> 00:09:57.300 It's a simple, 00:09:58.000 --> 00:09:58.780 pure Python package 00:09:59.060 --> 00:10:01.120 that only runs in free-threaded Python. 00:10:01.620 --> 00:10:02.720 What it does is, 00:10:04.100 --> 00:10:06.440 is you literally import the project, 00:10:06.780 --> 00:10:08.700 import Gilguard at the top. 00:10:08.960 --> 00:10:11.400 Now, you probably need to do some kind of like rough 00:10:11.860 --> 00:10:15.240 or hashtag ignore this unused import. 00:10:15.860 --> 00:10:18.020 Is this for development only? 00:10:18.200 --> 00:10:19.760 Like you wouldn't want to release this into production? 00:10:20.300 --> 00:10:20.940 Probably not. 00:10:21.120 --> 00:10:21.460 Well, okay. 00:10:21.660 --> 00:10:22.600 Let me show you the features. 00:10:22.660 --> 00:10:23.300 Then you talk about it. 00:10:23.300 --> 00:10:23.340 Okay. 00:10:23.680 --> 00:10:23.820 Okay. 00:10:24.700 --> 00:10:26.460 The way it's written here, probably not. 00:10:27.540 --> 00:10:31.700 So what you can do is you can put import Gilguard at the top before all of your other imports. 00:10:31.800 --> 00:10:34.120 You don't want it to get reordered because it's I sort, 00:10:34.320 --> 00:10:35.220 you know, the sort the imports. 00:10:35.440 --> 00:10:36.900 That's going to change what it means. 00:10:38.160 --> 00:10:41.740 So it has to be the first because what it does is it knows it's running on free thread of Python 00:10:42.060 --> 00:10:43.960 and that the Gil is not enabled because it's the first thing. 00:10:44.280 --> 00:10:45.860 And then anything else that gets imported, 00:10:46.020 --> 00:10:47.800 either on this page, the next page, 00:10:48.000 --> 00:10:48.560 lazy imported 00:10:48.860 --> 00:10:53.720 in some other module that imports another module that then turns the gil back on. 00:10:54.100 --> 00:10:56.480 What you get is an exception with a whole ton of details. 00:10:57.120 --> 00:10:58.440 Crash, the gil has been re-enabled. 00:10:58.880 --> 00:11:01.160 And then this module from this file, 00:11:01.340 --> 00:11:01.900 this version, 00:11:02.260 --> 00:11:04.100 and this is the import sequence that it took 00:11:04.220 --> 00:11:04.680 to get there. 00:11:04.960 --> 00:11:05.720 All that kind of stuff. 00:11:06.120 --> 00:11:06.580 That's cool, right? 00:11:06.840 --> 00:11:07.380 That's really cool. 00:11:07.920 --> 00:11:09.800 It's not like you just named the package. 00:11:10.020 --> 00:11:11.440 You're like, no, it's right here. 00:11:11.880 --> 00:11:12.000 Exactly. 00:11:13.300 --> 00:11:13.520 Yes, 00:11:13.740 --> 00:11:13.840 exactly. 00:11:14.340 --> 00:11:15.540 And here's the file. 00:11:16.010 --> 00:11:19.720 And then here is the sequence of import statements that got you to this file. 00:11:19.850 --> 00:11:19.940 Right. 00:11:20.230 --> 00:11:20.340 Exactly. 00:11:20.740 --> 00:11:21.780 So if you'd like to go fix it, 00:11:22.800 --> 00:11:23.220 here's the pointer. 00:11:23.640 --> 00:11:27.480 And I mean, the fix is like you go complain to the maintainer or you do a PR. 00:11:27.650 --> 00:11:28.100 I don't know. 00:11:28.310 --> 00:11:29.240 You stop using it. 00:11:29.500 --> 00:11:29.620 Yeah. 00:11:29.750 --> 00:11:29.880 Yeah. 00:11:30.080 --> 00:11:31.380 But there is no fix. 00:11:31.900 --> 00:11:33.280 Like the gills coming back on. 00:11:33.720 --> 00:11:37.520 I mean, I guess you can ignore it, but it's kind of like it's there's a way to say like, 00:11:37.530 --> 00:11:39.900 I don't care, like YOLO mode sort of for the runtime. 00:11:40.240 --> 00:11:41.540 But that's not the default. 00:11:41.650 --> 00:11:42.400 You got to choose it. 00:11:42.500 --> 00:11:42.560 Okay. 00:11:42.940 --> 00:11:45.440 So this is what it does by default. 00:11:45.610 --> 00:11:46.980 And if you ask about the, 00:11:47.840 --> 00:11:49.120 do I run this in production? 00:11:49.320 --> 00:11:50.260 Probably not like this. 00:11:50.600 --> 00:11:50.700 Maybe, 00:11:50.900 --> 00:11:52.000 but let's say probably not. 00:11:53.040 --> 00:11:54.900 I don't know, unless you want it to crash and then just like, 00:11:55.040 --> 00:11:57.400 I'd rather crash and then have like such a horrible performance. 00:11:57.660 --> 00:11:59.260 But I'm going to go with no on that. 00:11:59.600 --> 00:12:02.820 So another thing you can do on any virtual environment 00:12:03.330 --> 00:12:05.480 is you can just run python-m-gilgard. 00:12:05.820 --> 00:12:06.980 And instead of running your app, 00:12:07.030 --> 00:12:09.820 it will individually create a separate Python runtime 00:12:10.190 --> 00:12:12.480 and import each module separately. 00:12:12.920 --> 00:12:13.640 and to give you a report. 00:12:13.940 --> 00:12:15.640 It'll say like, I imported all these modules 00:12:16.000 --> 00:12:17.600 and one of them turned the GIL on. 00:12:17.670 --> 00:12:19.360 For example, I ran this on Talk Python training, 00:12:20.680 --> 00:12:22.060 114 modules it imported. 00:12:22.400 --> 00:12:23.980 When it checked the virtual environment 00:12:24.070 --> 00:12:24.760 for the runtime stuff, 00:12:24.960 --> 00:12:26.560 113 of them were fine, 00:12:26.590 --> 00:12:28.140 but one of them, this PDF thing, 00:12:28.620 --> 00:12:29.420 turned the GIL back on. 00:12:29.800 --> 00:12:30.280 And guess what? 00:12:30.440 --> 00:12:31.960 It's not running in process anymore. 00:12:32.240 --> 00:12:33.120 I don't know what we're doing with it, 00:12:33.560 --> 00:12:35.400 but it's, I mean, just running as a, 00:12:35.400 --> 00:12:36.920 so this is like a generated PDF. 00:12:37.090 --> 00:12:39.360 I could easily just do that as a multi-processing 00:12:39.420 --> 00:12:41.100 or sub-process and get the answer. 00:12:41.760 --> 00:12:42.680 and that fixes that, right? 00:12:42.720 --> 00:12:44.420 It's not always you gotta replace it. 00:12:44.540 --> 00:12:45.600 I kinda like that you could run this 00:12:45.720 --> 00:12:46.660 as like a pre-commit hook, 00:12:46.920 --> 00:12:48.540 like so I can just continually get a report 00:12:48.900 --> 00:12:50.280 or after an event of like, 00:12:50.560 --> 00:12:52.820 I added a new import into my project 00:12:53.080 --> 00:12:53.960 or new dependency, 00:12:54.660 --> 00:12:55.080 I'd wanna know. 00:12:55.360 --> 00:12:55.500 Yeah, 00:12:55.740 --> 00:12:56.100 or CI, 00:12:56.500 --> 00:12:56.920 how about this? 00:12:57.000 --> 00:13:01.360 The next feature is it also has a pytest plugin. 00:13:01.840 --> 00:13:02.960 So you could just run it, 00:13:03.160 --> 00:13:04.800 run your pytests with the GoR. 00:13:04.980 --> 00:13:05.720 Why would you not do this? 00:13:05.880 --> 00:13:07.560 This is gonna save a lot of head scratching 00:13:07.740 --> 00:13:08.660 from a lot of people who are like, 00:13:08.700 --> 00:13:09.860 why is my thing not running faster? 00:13:10.740 --> 00:13:14.880 right it went for a while and then it gets worse right and they may be blaming free threading when 00:13:14.960 --> 00:13:19.160 it's not actually free threading's fault it's some dependency that brought in and permanently 00:13:19.660 --> 00:13:24.180