Creating with Python

Y’know, you can just create things.

The start

My first real taste of Python was in my first programming job. I was writing COBOL for a regional insurance company, and quickly grew tired of writing code in the TRS-80 emulator. So I created a simple system to write COBOL in Sublime Text, using JCL FTP & compile jobs, a clever auto-save plugin, and my own custom Sublime Text plugin…written in Python.

For a while it, it was an esoteric toy language for me that I rarely used, until I moved into AppSec.

Quickly I found myself in a position where I often needed to float between security analyst, project manager, and software engineer all rolled into a generalist position titled, “Application Security Engineer”. With demand for enough functions and a lack of funding, I quickly found myself needing to create my own tools. Everything from crude vulnerability management tools, to CLI programs, and wrappers around container scanning utilities.

Turns out, a losely-typed, interpreted language with a concise syntax is a great enabler for creating tools to get basic things done.

So, with that I’ve been learning more and wanted to start publishing my work. Here's a small step in that direction.

Rolodex

https://github.com/meddlin/rolodex

Rolodex is a simple SQlite-based CRM application. It has a basic CLI interface. My main inspiration for this was to keep notes around work and coworkers while working remotely, all to promote better relationships.

Here are some quick highlights about the process

Moving from flat scripts to module-based architecture

Full transparency: did this with Cursor and ChatGPT. It’s just quicker than repeatedly Googling things. But why should we move from flat scripts to a module-based architecture?

  • Better namespace management and encapsulation
  • Packaging tools like setuptools assumes a module-based structure
  • Better maintainability (by avoiding circular imports,
  • PyPi packages need to be installable as a library

Admittedly, I don’t yet fully understand all of the details for each of these reasons, but generally, this was the motivation to shift towards a modules-based approach.

PyPi

Basically, PyPi is how Python packages are distributed. It’s the NPM of the Python world. So, I wanted my code on it. Simple as that.

setuptools vs hatchling

I chose setuptools. I’m not sure of the differences between the two. ChatGPT was giving me code that suited hatchling until I requested setupools. You can Google/manually look all of this up if you want. However, ChatGPT and Cursor honestly saved me hours of perusing documentation to get this working.

Bonus: Once you get a simple PoC setup and working, use ChatGPT/Cursor to supplement your manual research for explanations and deeper research on why each piece works the way it does.

thoughts & automation

Honestly, even after help from AI, I still don’t feel like I understand what’s happening exactly. Python’s build system and development experience feels haphazard. It works, but between requirements.txt, pyproject.toml, manifest.in, spec files, and wheels (and maybe something else I’m forgetting)…I get the sense some of this is unnecessary or redundant.

I was glad to get this automated with GitHub Actions. More so, I was glad to speedrun getting all of this stood up by using ChatGPT as part of the learning experience. Perhaps that’s the bigger story here.