4 ms·

As a non-Python person: Is it an easy mistake to make, for someone to inadvertently commit and push a "secret PyPI token"?

macintux 6y ago
Secrets in general leak into source code all the time, nothing specific about PyPI.
hannasanarion 6y ago
If you are trying to publish your package for other people to download through the `pip` package manager, then yeah. Most python devs will probably never publish to PyPi, but this can save some headaches for those who do, especially for the first time.
klyrs 6y ago
I can certainly imagine putting a token into a deploy script in the same directory as a python package's repo. From there, it's a typo away from getting added and committed to the repo. So, it's better to keep those tokens elsewhere.
- einpoklum 6y ago
  Isn't it totally verboten to put secret tokens / passwords into scripts? Regardless of language? When I write, say, bash scripts which do work using ssh, I don't specify a password: The user running the script will provide their own manually, or use ssh-copy-id, or edit the authorized_keys file on the target machine if they want to save themselves some typing. That is - authentication is decoupled from my script's actual work. Why is that not how things work with PyPI?
  - progval 6y ago
    It is. But even if it is strongly discouraged, some people will commit it anyway. Look at any beginner's repository, there is a high chance it contains files compiled from the source of the repo (executable, .pyc, ...), the developer's IDE config (.vscode, ...), __MACOSX, ...
  - klyrs 6y ago
    > Isn't it totally verboten to put secret tokens / passwords into scripts? It's only a rule because people have made the mistake enough to learn the lesson...
  - dragonwriter 6y ago
    > Isn't it totally verboten to put secret tokens / passwords into scripts? No, it's not “totally verboten” (forbidden by whom?), and people do it all the time. Mostly, perhaps, for stuff they aren't planning to share, but plans change. It doesn't help that lots of example code embeds placeholders for secrets directly (with notes to replace with your actual credentials), so lots of stuff gets embedded in the course of copy-and-paste coding.
progval 6y ago
I think not. The standard tools read the token from ~/.pypirc (or the console if absent). Inadvertent commits of the token probably only happens if you have a custom script with a hardcoded token.

macintux 6y ago

Secrets in general leak into source code all the time, nothing specific about PyPI.

hannasanarion 6y ago

If you are trying to publish your package for other people to download through the `pip` package manager, then yeah. Most python devs will probably never publish to PyPi, but this can save some headaches for those who do, especially for the first time.

klyrs 6y ago

I can certainly imagine putting a token into a deploy script in the same directory as a python package's repo. From there, it's a typo away from getting added and committed to the repo. So, it's better to keep those tokens elsewhere.

einpoklum 6y ago
Isn't it totally verboten to put secret tokens / passwords into scripts? Regardless of language? When I write, say, bash scripts which do work using ssh, I don't specify a password: The user running the script will provide their own manually, or use ssh-copy-id, or edit the authorized_keys file on the target machine if they want to save themselves some typing. That is - authentication is decoupled from my script's actual work. Why is that not how things work with PyPI?
- progval 6y ago
  It is. But even if it is strongly discouraged, some people will commit it anyway. Look at any beginner's repository, there is a high chance it contains files compiled from the source of the repo (executable, .pyc, ...), the developer's IDE config (.vscode, ...), __MACOSX, ...
- klyrs 6y ago
  > Isn't it totally verboten to put secret tokens / passwords into scripts? It's only a rule because people have made the mistake enough to learn the lesson...
- dragonwriter 6y ago
  > Isn't it totally verboten to put secret tokens / passwords into scripts? No, it's not “totally verboten” (forbidden by whom?), and people do it all the time. Mostly, perhaps, for stuff they aren't planning to share, but plans change. It doesn't help that lots of example code embeds placeholders for secrets directly (with notes to replace with your actual credentials), so lots of stuff gets embedded in the course of copy-and-paste coding.

progval 6y ago

I think not. The standard tools read the token from ~/.pypirc (or the console if absent). Inadvertent commits of the token probably only happens if you have a custom script with a hardcoded token.