3 ms·

> "We should sign and verify all our dependencies" pypi: "YOLO, let us deprecate signatures!"

by LtWorf 3y ago

esafak 3y ago
If pypi won't let you add signatures, can you generate one of your own (for internal use) using a repository manager like jfrog, operating as a pypi proxy?
- hiatus 3y ago
  New signatures cannot be uploaded to pypi https://blog.pypi.org/posts/2023-05-23-removing-pgp/ https://blog.pypi.org/posts/2023-05-23-removing-pgp/
  - LtWorf 3y ago
    They email me at every upload telling me to stop sending them my archaic signature. It seems the focus now is more to keep the secrets on github and authenticate with those. https://discuss.python.org/t/2fa-usability-on-pypi-and-with-packaging-tools/38167/29 https://discuss.python.org/t/2fa-usability-on-pypi-and-with-...
    - api 3y ago
      The sheer amount of eggs in the GitHub basket is absolutely terrifying to me. If something happens to that thing, the entire computing world will halt. It reminds me a bit of what the journalism world did by becoming so reliant on Twitter for sourcing and communication, but in our case I think it's deeper and worse. We've hard coded GitHub into countless systems. I'd venture to say that most CI systems, package managers, build farms, etc. would break.
      - LtWorf 3y ago
        Debian would keep working :D And at work my team uses a mirror on LAN. The other teams on the other hand…
- LtWorf 3y ago
  I use .deb packages mostly rather than pip. Signatures are checked if present, at least. Also packages that stop working because python removes stdlib modules that they use, tend to get found and patched in distributions. In pypi if they are abandoned, they will be unusable for all eternity.
- chha 3y ago
  Not sure about jfrog, but Sonatype does something similar. They basically hash all components/packages from a bunch of different repositories, and then tag the hash with various metadata you can use to create policies. I started using this in my org a couple years back, and we've ended up using it to check commercial software as well just to get an overview of known components, vulnerabilities and things to watch out for. I really wish the big repositories would invest more in useful mechanisms; when we looked into this before making our decision, the only repository with any kind of checking was Maven Central. Nuget had support for author signing and repository signing, and Pypi (at the time) author signing. As far as I remember none of the other repositories had any verification of anything including the git repo, so you couldn't even determine what commit hash the code was based on or who was behind it.

> "We should sign and verify all our dependencies" pypi: "YOLO, let us deprecate signatures!"

by LtWorf 3y ago

> "We should sign and verify all our dependencies" pypi: "YOLO, let us deprecate signatures!"

If pypi won't let you add signatures, can you generate one of your own (for internal use) using a repository manager like jfrog, operating as a pypi proxy?

hiatus 3y ago
New signatures cannot be uploaded to pypi https://blog.pypi.org/posts/2023-05-23-removing-pgp/ https://blog.pypi.org/posts/2023-05-23-removing-pgp/
- LtWorf 3y ago
  They email me at every upload telling me to stop sending them my archaic signature. It seems the focus now is more to keep the secrets on github and authenticate with those. https://discuss.python.org/t/2fa-usability-on-pypi-and-with-packaging-tools/38167/29 https://discuss.python.org/t/2fa-usability-on-pypi-and-with-...
  - api 3y ago
    The sheer amount of eggs in the GitHub basket is absolutely terrifying to me. If something happens to that thing, the entire computing world will halt. It reminds me a bit of what the journalism world did by becoming so reliant on Twitter for sourcing and communication, but in our case I think it's deeper and worse. We've hard coded GitHub into countless systems. I'd venture to say that most CI systems, package managers, build farms, etc. would break.
    - LtWorf 3y ago
      Debian would keep working :D And at work my team uses a mirror on LAN. The other teams on the other hand…
LtWorf 3y ago
I use .deb packages mostly rather than pip. Signatures are checked if present, at least. Also packages that stop working because python removes stdlib modules that they use, tend to get found and patched in distributions. In pypi if they are abandoned, they will be unusable for all eternity.
chha 3y ago
Not sure about jfrog, but Sonatype does something similar. They basically hash all components/packages from a bunch of different repositories, and then tag the hash with various metadata you can use to create policies. I started using this in my org a couple years back, and we've ended up using it to check commercial software as well just to get an overview of known components, vulnerabilities and things to watch out for. I really wish the big repositories would invest more in useful mechanisms; when we looked into this before making our decision, the only repository with any kind of checking was Maven Central. Nuget had support for author signing and repository signing, and Pypi (at the time) author signing. As far as I remember none of the other repositories had any verification of anything including the git repo, so you couldn't even determine what commit hash the code was based on or who was behind it.