4 ms·
Python has fully-hashed requirements[1], which is what you'd use to assert the integrity of your dependencies. These work with both `pip` and `uv`. You can't us
by woodruffw 2y ago
Python has fully-hashed requirements[1], which is what you'd use to assert the integrity of your dependencies. These work with both `pip` and `uv`. You can't use them to directly import the package, but that's more because "packages" aren't really part of Python's import machinery at all.
(Note that hashes themselves don't make "random scripts" not a security risk, since asserting the hash of malware doesn't make it not-malware. You still need to establish a trust relationship with the hash itself, which decomposes to the basic problem of trust and identity distribution.)
[1]: https://pip.pypa.io/en/stable/topics/secure-installs/ https://pip.pypa.io/en/stable/topics/secure-installs/
- gregmac 2y agoGood point, but it's still a very useful way to ensure it doesn't get swapped out underneath you. Transitive dependencies are still a problem though. You kind of fall back to needing a lock file or specifying everything explicitly.
- 8n4vidtmkvmk 2y agoRight, still a security risk, but at least if I come back to a project after a year or two I can know that even if some malicious group took over a project, they at least didn't backport a crypto-miner or worse into my script.