search

pypa / packaging-problems

An issue tracker for the problems in packaging
150 stars 34 forks source link

No Signing of Packages #15

Open dstufft opened 11 years ago

dstufft commented 11 years ago

There is no real and useful signing of packages. It would be great to have this to ensure download and upload integrity.

This is likely going to be solved with the possible introduction of TUF at a future point in time.

daenney commented 11 years ago

Considering the Rubygems hack of early this year and the attack on Python's wiki infrastructure I'm not sure we can afford to wait for 'a future point in time'.

The seemingly standard way of doing this is to provide a GPG signed checksums file containing a hash of every file in the package. The issue usually is that not everyone verifies those because GPG can be a wee bit confusing to people and there's no guarantee the developer actually securely manages and stores his GPG key.

ncoghlan commented 11 years ago

By "a future point in time", Donald actually means "the researchers behind The Update Framework are actively working on a solution that will actually be used, unlike GPG signing which is technically already supported, but nobody actually uses due to the key management problem".

TUF website: http://www.updateframework.com/projects/project Mailing list: https://groups.google.com/forum/?fromgroups#!forum/theupdateframework

The Rubygems compromise was indeed a wake-up call that finally silenced a lot of people that had been objecting to attempts at hardening the distribution ecosystem as not worth the effort, and many security improvements have been made since then. The challenge the TUF folks are tackling is making it possible to survive a compromise of PyPI (at least for higher profile packages) without substantially raising the barrier to entry for new users distributing their first packages.

ncoghlan commented 11 years ago

Oh, nice, according to Trishank's latest update to the TUF list, the first public draft of their PEP should be published any day now: https://groups.google.com/forum/?fromgroups#!topic/theupdateframework/clYqvu8KzZ8

daenney commented 11 years ago

My apologies, when people say things like 'a future point in time' I've come to interpret that as "when pigs can fly".

ncoghlan commented 11 years ago

In this case, "after Python 3.4 and pip 1.5" is the main meaning (we had to scale several things back to focus on what was needed to meet the Python 3.4 deadlines for PEP 453).

alex commented 11 years ago

Existing gpg signatures which are uploaded aren't actually verified right? It'd be nice if that was an option.

brainwane commented 6 years ago

Here's the basic current state of things regarding PyPI and GPG signing of packages, at least as of a few months ago: https://github.com/travis-ci/dpl/issues/727#issuecomment-359203157

brainwane commented 6 years ago

Another summary of the current status of things is in https://lwn.net/SubscriberLink/751458/81b2759e7025d6b9/ .

brainwane commented 5 years ago

Package signing on PyPI will be part of Warehouse security work funded by a gift from Facebook that the Warehouse team will start working on later in 2019. The work includes "Cryptographic signing and verification of artifacts (PEP 458/TUF or similar)" and additional features (milestone).

https://github.com/pypa/warehouse/issues/5247 has more detail on the current discussion around TUF.