Open manfred-kaiser opened 3 years ago
the request to https://pypi.org/pypi/python-appimage/json should be removed, because it breaks workflows, when running without an internet connection.
Another reason is, that you are using _create_unverified_context, which disables certificate validation.
_create_unverified_context
This makes using you package insecure and prone to man in the middle attacks.
Determine the version number this way also breaks reproducible builds.
Is the security aspect of this resolved yet?
the request to https://pypi.org/pypi/python-appimage/json should be removed, because it breaks workflows, when running without an internet connection.
Another reason is, that you are using
_create_unverified_context
, which disables certificate validation.This makes using you package insecure and prone to man in the middle attacks.
Determine the version number this way also breaks reproducible builds.