Chainguard Libraries for Python on

Chainguard Libraries for Python overview

Wed, 09 Apr 2025 04:00:00 +0000

Chainguard Libraries for Python provides enhanced security for the vast Python ecosystem by rebuilding PyPI packages with comprehensive supply chain protection and automated patching. With over 600,000 packages on the Python Package Index (PyPI) serving application development, machine learning, and data science needs, Chainguard addresses the critical security challenges of depending on packages from untrusted sources by rebuilding them within the controlled Chainguard Factory environment. In addition, Chainguard eliminates security risk by remediating High and Critical vulnerabilities across older package versions where upstream maintainers are not able to prioritize fixes.

Global configuration

Tue, 25 Mar 2025 08:04:00 +0000

Python library consumption in a large organization is typically managed by a repository manager. Commonly used repository manager applications are Cloudsmith, JFrog Artifactory, and Sonatype Nexus Repository. The repository manager acts as a single point of access for developers and development tools to retrieve the required libraries.

The recommended approach is to use the upstream fallback feature of Chainguard Repository, which allows you to configure your repository manager with a single upstream pointed at https://libraries.cgr.dev/python/. The Chainguard Repository handles fallback and policy enforcement; your repository manager handles local caching and access control. Chainguard proxies and serves packages from the public PyPI repository on your behalf when upstream fallback is enabled. All packages served from Chainguard are protected with malware scanning and a configurable cooldown policy.

Configure Python build tools

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Python works with your existing build tools — pip, Poetry, and uv — through a repository configuration change. This page is a reference for configuring each supported build tool. It covers repository access, authentication, cache clearing, and minimal example projects.

Apply these changes on every workstation and build server that builds your applications or downloads libraries, including CI/CD infrastructure such as Jenkins, TeamCity, or GitHub Actions.

The https://libraries.cgr.dev/python/ endpoint is also the Chainguard Repository endpoint for Python. By default, it serves only Chainguard-built artifacts. When upstream fallback is enabled for your organization, the same endpoint can also serve requested versions from PyPI under Chainguard security controls.

Management and maintenance

Tue, 25 Mar 2025 08:04:00 +0000

Chainguard Libraries for Python operates transparently after completing the global configuration and build configuration, automatically providing security-enhanced versions of your PyPI dependencies. New packages and versions are retrieved from Chainguard’s hardened repository when available, while PyPI and other configured repositories provide fallback access to ensure continuous development workflow without interruption.

The following sections detail optional management, maintenance, and auditing steps on the repository manager and the build tool.

Source verification

You can verify what artifacts are retrieved from the Chainguard Libraries repository on a global level:

Migrating a Python project to Chainguard Libraries

Tue, 14 Jul 2026 00:00:00 +0000

Chainguard Libraries for Python provides a curated index of PyPI packages rebuilt from source and verified against Chainguard’s build provenance. Because Chainguard Libraries uses the standard pip simple-index protocol, switching an existing project requires only an index configuration change — no changes to your application code or dependency declarations.

This guide walks through migrating an existing Python project to Chainguard Libraries, covering the two most common setups:

Direct access: Your build tool connects directly to libraries.cgr.dev. This option is faster for initial evaluation and smaller-scale setups.
Repository manager: Your build tool connects to a repository manager (such as JFrog Artifactory or Sonatype Nexus), which proxies requests to Chainguard Libraries. This option is recommended for teams and organizations.

To follow along with a ready-made project instead of your own, use the Chainguard Libraries for Python demo repository. It provides example projects for pip, uv, and Poetry, each with a demo.sh script that configures access and installs sample packages.