search

niess / python-appimage

AppImage distributions of Python
https://python-appimage.readthedocs.io/en/latest/
GNU General Public License v3.0
170 stars 24 forks source link

setup.py - remove insecure requests to https://pypi.org/pypi/python-appimage/json #36

Open manfred-kaiser opened 3 years ago

manfred-kaiser commented 3 years ago

the request to https://pypi.org/pypi/python-appimage/json should be removed, because it breaks workflows, when running without an internet connection.

Another reason is, that you are using _create_unverified_context, which disables certificate validation.

This makes using you package insecure and prone to man in the middle attacks.

Determine the version number this way also breaks reproducible builds.

hendursaga commented 4 months ago

Is the security aspect of this resolved yet?