5 ms·

I am very surprised that a package manager of this calibre and impact abstains from best practices when it comes to authentication through code-signing. Other p

I am very surprised that a package manager of this calibre and impact abstains from best practices when it comes to authentication through code-signing. Other package managers are miles ahead of NPM. For example, Nix, which uses immutability and hashing to always produce the same artifact, regardless of changes of the sources.

djsumdog 9y ago
So I know rpms and debs are signed, as I've setup repos for both. Docker repositories require a valid SSL key (or you have to manually allow untrusted repos). But do Python packages and Ruby gems have signature verification? How does pypy/pip and gem deal with validating a package is what it claims to be?
- viraptor 9y ago
  Traditional python packages support GPG signing: https://pypi.python.org/security https://pypi.python.org/security There's new experimental signing in wheels: https://wheel.readthedocs.io/en/stable/#automatically-sign-wheel-files https://wheel.readthedocs.io/en/stable/#automatically-sign-w... and the signing defined in PEP: https://www.python.org/dev/peps/pep-0427/#signed-wheel-files https://www.python.org/dev/peps/pep-0427/#signed-wheel-files
- cpburns2009 9y ago
  PyPI (which is what Pip uses) at the very least does not require authors to sign their packages. I can't say whether it supports signing though.
- ek750 9y ago
  Ruby gems can be signed but the percentage of gems authors taking advantage of that is low. At least we’ve got most people using https to transfer gems now!
johnny22 9y ago
comparing distro package managers is a ton different than free for all spaces like packagist, ruby gems, pypi, npm, etc.
- edejong 9y ago
  You have a point, but we need to take into account that the technology has been around for a long time, the risks are well known and documented, and safety concerns of most of these package managers have been addressed to maintainers. The example in the article has come to light accidentally, but we must seriously ask ourselves how many incidents are currently unidentified. Besides, you can use Nix for 'normal' development. It is suitable for more things than just a distro package manager.

djsumdog 9y ago

So I know rpms and debs are signed, as I've setup repos for both. Docker repositories require a valid SSL key (or you have to manually allow untrusted repos). But do Python packages and Ruby gems have signature verification? How does pypy/pip and gem deal with validating a package is what it claims to be?

viraptor 9y ago
Traditional python packages support GPG signing: https://pypi.python.org/security https://pypi.python.org/security There's new experimental signing in wheels: https://wheel.readthedocs.io/en/stable/#automatically-sign-wheel-files https://wheel.readthedocs.io/en/stable/#automatically-sign-w... and the signing defined in PEP: https://www.python.org/dev/peps/pep-0427/#signed-wheel-files https://www.python.org/dev/peps/pep-0427/#signed-wheel-files
cpburns2009 9y ago
PyPI (which is what Pip uses) at the very least does not require authors to sign their packages. I can't say whether it supports signing though.
ek750 9y ago
Ruby gems can be signed but the percentage of gems authors taking advantage of that is low. At least we’ve got most people using https to transfer gems now!

johnny22 9y ago

comparing distro package managers is a ton different than free for all spaces like packagist, ruby gems, pypi, npm, etc.

edejong 9y ago
You have a point, but we need to take into account that the technology has been around for a long time, the risks are well known and documented, and safety concerns of most of these package managers have been addressed to maintainers. The example in the article has come to light accidentally, but we must seriously ask ourselves how many incidents are currently unidentified. Besides, you can use Nix for 'normal' development. It is suitable for more things than just a distro package manager.