CPython

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

alpha, beta, and release candidates are tagged in git and released at https://www.python.org/downloads/.

Repository on GitHub, which uses git. git is distributed.

Major changes are listed in the official documentation, e.g. https://docs.python.org/3/whatsnew/3.8.html for Python 3.8. CPython also has a more detailed changelog https://docs.python.org/3/whatsnew/changelog.html

Security fixes and CVE numbers are mentioned in the whatsnew text and in the more detailed changelog, https://docs.python.org/3/whatsnew/changelog.html

Python hosts an instance of Roundup issue tracker at https://bugs.python.org/

The issue tracker is https://bugs.python.org/

A developer or reviewer usually responds within a couple of hours to days.

Issues are archived at https://bugs.python.org/

https://www.python.org/dev/security/ The page is linked from the footer of every page on https://www.python.org/

https://www.python.org/dev/security/ lists the public GPG key of the Python Security Response Team.

CPython sources come with autoconf/automake build system and Visual Studio project files.

CPython uses automake, autoconf, standard C compiler (GCC, clang), and supports Visual Studio.

autoconf, automake, GCC

CPython comes with a full unit test suite built-in.

CPython uses the default Python unittest framework to run tests.

Pull requests on Github are tested with Travis CI, Azure Pipelines, and AppVeyor. Additional testing is performed with buildbots (https://www.python.org/dev/buildbot/).

The policy is documented in the development guide https://devguide.python.org/ and enforced by reviewers.

See https://github.com/python/cpython/commits/master/Lib/test

https://devguide.python.org/pullrequest/#making-good-prs

The default Makefile enables warnings like -Wall -Wextra and several other compiler specific warnings like -Wno-unused-result -Wsign-compare -Wno-unused-result -Wno-unused-parameter -Wno-missing-field-initializers -Werror=implicit-function-declaration

CPython's C code generally compiles without warnings. Warnings are addressed in new releases.

CPython enables most C warnings flags (-Wall -Wextra and several additional flags). Warnings are considered bugs and are usually fixed before the next release.

The Python Core Developer team has several members with security background.

CPython uses OpenSSL for hashing, HMAC and TLS. It only supports widely accepted protocols and algorithns.

CPython relies on OpenSSL for TLS and does not enforce additional restrictions on top of OpenSSL.

MD4, DES, and RC4 are not supported and disabled for TLS protocol. MD5 is available but no longer used except for few legacy protocols like DIGEST auth.

CPython configures strong, secure defaults for TLS.

PFS key agreement is used by default for TLS.

CPython provides wrappers for OpenSSL's PBKDF2-HMAC and scrypt implementation.

Python uses the operation systems CSPRNG and OpenSSL's DRBG for TLS.

CPython uses LGTM (https://lgtm.com/projects/g/python/cpython), Coverity Scan, and some developers check the C code with clang scan-build

As of today LGTM and Coverity don't list any errors, only some warnings, recommendations, or false positives

LGTM scans the code regularly.

CPython is part of OSS-Fuzz https://github.com/google/oss-fuzz/tree/master/projects/python3-libraries