3 ms·

Signed .eggs (can be handled just like signed rars) and .pyc files would be a feasible and proven way to address this. Sure, even that can be subverted if the

Signed .eggs (can be handled just like signed rars) and .pyc files would be a feasible and proven way to address this. Sure, even that can be subverted if the private key is compromised, but at least a random trojan can't infect it anymore.

wyuenho 15y ago
How do u propose PyPI or the package maintainers/users deal with key exchange? I'm not aware of anything that allows u to sign Python code now, at least not commonly used anyway. Python's state of packaging is kinda sad really. It's even worse then Javaland.
- wladimir 15y ago
  In the same way as the android store, for example; force package maintainers to sign their packages before uploading. This can be done with a self-signed key, as long as the signature proves the files originate from the maintainer. Of course, tooling for this would have to be written, or maybe even the jar-signing tools could be used (as eggs and jars are both zip files with metadata).
  - wyuenho 15y ago
    I'm not sure how this would work as I have no experience with the Android App Store so I could be really wrong here but please do correct me. AFAIK, a typical code signing process required these steps: 1) Get a cert/key whatever, you can generate your own or some server can generate it for you. As long as both of you trust it, it's ok. 2) You sign your code and upload it to the server 3) When a client requests for the code, the client establish a secure channel with the server and then the server will send the key over with the data to the client. The client decrypts it. If you do this, the cert/key is usually generated by the server. 4) Or the key is somehow stored on the client side beforehand. This is logistical nightmare and potential security hole if the key is properly protected. Since no sane person will choose 4) to distribute Python packages you can download from PyPI, you are stuck with 3). Guess what. You still need SSL. Am I wrong here, did I miss anything?
    - wladimir 15y ago
      Hey, my point was not that SSL is not needed. By all means, convert the whole web to SSL! I was just trying to propose a way to make the PyPi repository somewhat more secure by making sure the maintainer signs the packages. This increases security somewhat (for example, if the server is compromised) in addition to SSL.

wyuenho 15y ago

How do u propose PyPI or the package maintainers/users deal with key exchange? I'm not aware of anything that allows u to sign Python code now, at least not commonly used anyway. Python's state of packaging is kinda sad really. It's even worse then Javaland.

wladimir 15y ago
In the same way as the android store, for example; force package maintainers to sign their packages before uploading. This can be done with a self-signed key, as long as the signature proves the files originate from the maintainer. Of course, tooling for this would have to be written, or maybe even the jar-signing tools could be used (as eggs and jars are both zip files with metadata).
- wyuenho 15y ago
  I'm not sure how this would work as I have no experience with the Android App Store so I could be really wrong here but please do correct me. AFAIK, a typical code signing process required these steps: 1) Get a cert/key whatever, you can generate your own or some server can generate it for you. As long as both of you trust it, it's ok. 2) You sign your code and upload it to the server 3) When a client requests for the code, the client establish a secure channel with the server and then the server will send the key over with the data to the client. The client decrypts it. If you do this, the cert/key is usually generated by the server. 4) Or the key is somehow stored on the client side beforehand. This is logistical nightmare and potential security hole if the key is properly protected. Since no sane person will choose 4) to distribute Python packages you can download from PyPI, you are stuck with 3). Guess what. You still need SSL. Am I wrong here, did I miss anything?
  - wladimir 15y ago
    Hey, my point was not that SSL is not needed. By all means, convert the whole web to SSL! I was just trying to propose a way to make the PyPi repository somewhat more secure by making sure the maintainer signs the packages. This increases security somewhat (for example, if the server is compromised) in addition to SSL.