
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
zc.buildout
Advanced tools
Buildout
.. image:: https://github.com/buildout/buildout/actions/workflows/run-tests.yml/badge.svg :alt: GHA tests report :target: https://github.com/buildout/buildout/actions/workflows/run-tests.yml
Buildout is a project designed to solve 2 problems:
Application-centric assembly and deployment
Assembly runs the gamut from stitching together libraries to create a running program, to production deployment configuration of applications, and associated systems and tools (e.g. run-control scripts, cron jobs, logs, service registration, etc.).
Buildout might be confused with build tools like make or ant, but it is a little higher level and might invoke systems like make or ant to get its work done.
Buildout might be confused with systems like puppet or chef, but it is more application focused. Systems like puppet or chef might use buildout to get their work done.
Buildout is also somewhat Python-centric, even though it can be used to assemble and deploy non-python applications. It has some special features for assembling Python programs. It's scripted with Python, unlike, say puppet or chef, which are scripted with Ruby.
Repeatable assembly of programs from Python software distributions
Buildout puts great effort toward making program assembly a highly repeatable process, whether in a very open-ended development mode, where dependency versions aren't locked down, or in a deployment environment where dependency versions are fully specified. You should be able to check buildout into a VCS and later check it out. Two checkouts built at the same time in the same environment should always give the same result, regardless of their history. Among other things, after a buildout, all dependencies should be at the most recent version consistent with any version specifications expressed in the buildout.
Buildout supports applications consisting of multiple programs, with different programs in an application free to use different versions of Python distributions. This is in contrast with a Python installation (real or virtual), where, for any given distribution, there can only be one installed.
To learn more about buildout, including how to use it, see https://www.buildout.org/.
Native namespaces and breaking changes in 5.x
Summary: zc.buildout 5.x installs most distributions with pip, even editable installs (with some remarks).
It automatically uses native namespaces for all packages, except editable installs.
Eggs go to directory eggs/v5 to avoid compatibility problems.
If a package name has a dot in it, it is a namespace package.
zc.buildout has zc as namespace.
Namespaces can be implemented in three ways:
native namespaces (PEP 420, since Python 3.3), pkg_resources style (with __init__.py files that call pkg_resources.declare_namespace) and pkgutil style (with __init__.py files that call pkgutil.extend_path).
Native namespaces are the modern way to do it. They work better with pip and other modern tools.
The pkg_resources style depends on setuptools and is considered deprecated: setuptools is scheduled to drop support for it at the end of 2025, removing its foundational pkg_resources module.
Problems start when you have multiple packages in the same namespace, that use different implementations.
But it depends on what you use to install the packages.
In the following examples, we have two packages in the same namespace, say ns.native (using native namespaces) and ns.deprecated (using pkg_resources style).
Make editable installs of both packages (pip install -e or in buildout, develop =):
horse-with-no-namespace <https://pypi.org/project/horse-with-no-namespace/>_ package to get this working.Make a normal install of both packages:
Make a normal install of one package and an editable install of the other:
horse-with-no-namespace to get this working.So the big difference between buildout 4.x and 5.x is that with 5.x you can mix namespace styles when you do normal installs. This is possible due to the following major changes in 5.x:
zc.buildout package itself uses native namespaces now.zc.buildout 5.x installs most packages with pip, with only rare exceptions.pkg_resources-style namespace package with pip, the __init__.py files would be missing, so we would explicitly add them again.
Now we no longer do this. In fact, in some cases these files are there after installation, and we explicitly remove them.eggs/v5.
Or with abi tags for example: eggs/v5/cp313.
So it should be fine to keep using the same shared eggs cache, even if you are using different zc.buildout versions.python setup.py develop to install them, failing if there was no setup.py file.
Now this file is no longer needed.
Theoretically this means that you could develop a package that uses for example hatchling as build system.
In practice this does not work yet, but the foundation is there.The Plone project is a major user of buildout, although alternative installation methods are becoming more popular. So what does this mean for Plone?
zc.buildout 4.x and pkg_resources-style namespaceszc.buildout 5.x.horse-with-no-namespace both when installed with pip and with zc.buildout.Change History
.. You should NOT be adding new change log entries to this file. You should create a file in the news directory instead. For helpful instructions, please see: https://github.com/buildout/buildout/blob/master/doc/ADD-A-NEWS-ITEM.rst
.. towncrier release notes start
New features:
setuptools to less than 82 if it is not pinned.
When zc.buildout checks if it should upgrade itself or setuptools, under some circumstances this could lead to a too new setuptools version getting installed.
[maurits]Tests:
pip 26.1. [maurits]Bug fixes:
Bug fixes:
setuptools 81.
Require setuptools<82.
[maurits]Bug fixes:
pip install -e package_name will look on PyPI, instead of a local package_name directory.
[maurits] (#734)New features:
Bug fixes:
setuptools<81.
We need the pkg_resources module which is scheduled for removal in 81.
[maurits] (#81)Tests:
pip 25.3. (#727)Bug fixes:
Bug fixes:
Breaking changes:
hatchling as build system.
In practice this does not work yet, but the foundation is there.
[maurits] (#676)eggs/v5.
Or with abi tags for example: eggs/v5/cp313.
[maurits] (#676)zc.buildout package itself uses native namespaces now. [maurits] (#676)setuptools version 61.0.0.
This is needed due to the changes in the test setup.
[maurits]Tests:
bootstrap.py.
[maurits]buildout.txt test file into multiple files.
[maurits]Bug fixes:
get_win_launcher not found on Windows on setuptools 80.3+.
[maurits] (#713)Bug fixes:
pip install --editable.
Note that "distutils scripts" can no longer be detected with setuptools 80.
This seems an ancient technology, and probably hardly used.
[maurits] (#708)package_index.py from setuptools 80.2.0.
This fixes compatibility with setuptools 80.3.0 where this module was removed.
Merged some of our patches into this copy.
[maurits] (#710)Bug fixes:
pkg_resources.Environment.can_add to have better results on Mac.
Without this, a freshly created Mac-specific egg may not be considered compatible.
This can happen when the Python you use was built on a different Mac OSX version.
[maurits] (#609)Bug fixes:
PYTHONPATH in os.environ when calling pip install.
[xavth] (#639)Tests
wheel 0.45.1 when testing with setuptools older than 70.1.0.
Otherwise, when combining an older setuptools with a newer wheel version, the bdist_wheel command exists in neither of these packages.
[maurits] (#705)Bug fixes:
Bug fixes:
.pyc files are in a __pycache__ directory, so it had no effect.
[maurits] (#699)packaging version 23.2.
Needed because we use the utils.is_normalized_name function.
[maurits] (#700)Tests
tar.gz instead of zip files.
Then our package index for testing is more like the actual PyPI.
[maurits] (#675)Bug fixes:
wheel before setuptools when checking if an upgrade and restart are needed.
[maurits] (#691)Bug fixes:
setuptools 75.8.1 or higher.
For namespace package we need a dot instead of an underscore in the resulting egg name.
[maurits] (#686)Bug fixes:
find method from pkg_resources.WorkingSet.
Let this use the code from setuptools 75.8.2, if the currently used version is older.
This is better at finding installed distributions.
But don't patch setuptools versions older than 61: the new version of the method would give an error there.
[maurits] (#682)Bug fixes:
zc.buildout distribution when checking if we need to upgrade/restart.
This depends on your setuptools version.
[maurits] (#681)Bug fixes:
zc.buildout version as requirement.
[maurits] (#679)New features:
ls testing method, add keyword argument lowercase_and_sort_output.
The default is False, so no change.
When true, as the name says, it sorts the output by lowercase, and prints it lowercase.
We need this in one test because with setuptools 75.8.1 we no longer have a filename MIXEDCASE-0.5-pyN.N.egg, but mixedcase-0.5-pyN.N.egg.
[maurits] (#7581)Bug fixes:
package.name, first try the normalized name (package_name).
This fixes an error finding entry points for namespace packages.
The error is: TypeError: ('Expected str, Requirement, or Distribution', None).
[maurits] (#7581)Development:
setuptools 75.8.2 and with pip 25.0.1.
Note that setuptools 75.8.1 can be troublesome and should be avoided.
[maurits] (#7581)Breaking changes:
Development:
setuptools == 75.6.0. (#671)Breaking changes:
packaging. This gets rid of ugly compatibility code.
[maurits] (#38)setuptools >= 49.0.0.
This is the first version that supports PEP 496 environment markers, for example demo ==0.1; python_version < '3.9'.
An earlier change had setuptools >= 42.0.2, otherwise we got ImportErrors.
Also, since this is higher than 38.2.3, we are sure to have support for wheels.
Remove support for distribute, which was probably already broken.
[maurits] (#38)New features:
FAQs
System for managing development buildouts
We found that zc.buildout demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Ā It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.