Dependency Management and Security in Python

IntermediateFree5 modules · 15 lessons

About this course

A working engineer's account of how Python actually resolves, installs and verifies dependencies, and where that behaviour surprises people who learned packaging somewhere else. You will cover requirements files against compiled files against a project definition with a resolver, the install time code execution that a source distribution implies, hash checking mode, index priority and the shadowing risk, native extensions and the components they hide. It closes with overriding a vulnerable transitive dependency, upgrading a library several major versions behind, and a policy that survives a polyglot estate.

What you'll learn

The Packaging Landscape as It Actually Is

Where a Python Dependency Actually Lives
Requirements, Compiled Requirements and a Project Definition
Source Distributions, Wheels and the Code That Runs at Install Time

Resolution, Extras and the Flat Namespace

How the Resolver Actually Chooses
Extras, Optional Dependencies and Dependency Groups
One Version Per Environment: Conflicts and the Diamond

Integrity, Indexes and What an Attacker Can Claim

Hash Checking Mode and Why Almost Nobody Turns It On
The Index, the Name and What an Attacker Can Claim
Index Priority, Private Sources and the Shadowing Risk

01The Packaging Landscape as It Actually Is3 lessons

Where a Python Dependency Actually Lives
Requirements, Compiled Requirements and a Project Definition
Source Distributions, Wheels and the Code That Runs at Install Time

02Resolution, Extras and the Flat Namespace3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Overriding, Native Code and Reproducibility

Overriding a Vulnerable Transitive Dependency
Native Extensions and What They Mean for Auditing
Reproducibility: Same File, Different Install

Living With It: Upgrades, the Long Tail and Policy

Upgrading a Dependency Several Major Versions Behind
The Long Tail: Pinned Data Science Stacks Nobody Wants to Touch
One Policy Across Ecosystems, and What Python Needs Written Down

How the Resolver Actually Chooses

Extras, Optional Dependencies and Dependency Groups

One Version Per Environment: Conflicts and the Diamond

03Integrity, Indexes and What an Attacker Can Claim3 lessons

Hash Checking Mode and Why Almost Nobody Turns It On
The Index, the Name and What an Attacker Can Claim
Index Priority, Private Sources and the Shadowing Risk

04Overriding, Native Code and Reproducibility3 lessons

Overriding a Vulnerable Transitive Dependency
Native Extensions and What They Mean for Auditing
Reproducibility: Same File, Different Install

05Living With It: Upgrades, the Long Tail and Policy3 lessons

Upgrading a Dependency Several Major Versions Behind
The Long Tail: Pinned Data Science Stacks Nobody Wants to Touch
One Policy Across Ecosystems, and What Python Needs Written Down

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.