python: signature verification can never succeed for Python 3.14+
Maintainer antworten meist innerhalb von 1 Tag
Dieses Issue hat noch niemand übernommen.
Bewertung
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Anfängerfreundlichkeit
- 52/100
Rechercherichtung
Start in src/python/install.sh around lines 532-591, where the cosign and signature downloads run. Reproduce the curl exit code 2 from -f combined with --fail-with-body, then check the .sigstore URL that python.org serves for 3.14+. Done means the downloads succeed, cosign verify-blob checks the bundle against the signer identity python.org lists, and a failed check stops the build or logs a real error.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Beschreibung
Summary
In the python feature (1.8.0, and src/python/install.sh on main), the cosign check for Python 3.14+ always fails, so these versions are always built from source without signature verification. The build continues and logs that this is expected for newly released versions, but it happens for every version.
Causes
-
Invalid curl flags. The cosign and signature downloads (lines 532, 544, 585, 591) pass both
-fand--fail-with-body, which curl rejects with exit code 2. Most of these calls send stderr to/dev/null, and none of them surfaces the real error, so it looks like a failed download.curl -L -f --fail-with-body https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz.crt -o /dev/null # curl: option --fail-with-body: is badly used here # exit code 2Reproduced with curl 8.14.1 (in a dev container built from
mcr.microsoft.com/devcontainers/base:debian) and curl 8.7.1 (macOS). With--fail-with-bodyalone, the same request exits 0. -
Wrong certificate URL. Lines 580-581 look for
.sigand.pem. For 3.14.10, python.org returns 200 for.sig,.crtand.sigstore, and 404 for.pem. Fixing the curl flags alone would still fail at this step. -
Any signer is accepted. The
cosign verify-blobcall uses--certificate-identity-regexp=".*"and--certificate-oidc-issuer-regexp=".*". Even a passing check wouldn't show that the Python release manager signed the file. -
The build continues after a failed check. If verification fails, the script logs a warning and builds the tarball anyway, and there is no checksum check. The warning says this is "expected for newly released versions where cosign signatures are not yet available", which hides the failure.
Impact
Every Python 3.14+ build from source through this feature skips signature verification. The tarball is still downloaded over HTTPS, so this doesn't create an attack by itself, but the protection that replaced PGP for 3.14+ isn't working.
Suggested fix
-
Remove
-ffrom the affected curl calls. -
Verify with the
.sigstorebundle and the signer identity that python.org lists for each release series. This command returnedVerified OKfor 3.14.10 with cosign 3.1.4, and failed when given a different identity:cosign verify-blob \ --bundle Python-3.14.10.tgz.sigstore \ --certificate-identity [email protected] \ --certificate-oidc-issuer https://github.com/login/oauth \ Python-3.14.10.tgz -
Consider failing the build when verification fails, or at least changing the warning so it doesn't describe a failure as expected.
- Vorherrschende Sprache
- Shell
- Sterne
- 1.6k
- Forks
- 628
- Ø Merge
- 1 T. 19 Std.
- Gemergte PRs (30 T.)
- 5
Entwicklungsumgebung
Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.
- Kein Dockerfile und keine Docker-Compose-Datei
- Keine Pull-Request-Vorlage
- Beitragsleitfaden lesen
Erste Schritte
- Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
- Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
- Forken Sie das Repository und arbeiten Sie in einem Branch.
- Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.
Mehr aus devcontainers/features
-
Terraform feature fails to install due to tflint checksumEvtl. vergeben @v-Kaniska244 hat das vor 4 Tagen übernommen. Offen
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 72/100
devcontainers/features#1757 · 1 Kommentar · 1 Reaktion · 2 zugewiesene Personen ·
Maintainer antworten meist innerhalb von 1 Tag
-
docker-outside-of-docker: processes started before the entrypoint's `groupmod` keep stale groups and cannot use the socketEvtl. vergeben Ein verknüpfter Pull Request ist offen oder bereits gemergt. Offen
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 18/100
devcontainers/features#1760 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 38/100
devcontainers/features#1754 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 4/5 3-5 Tage Anfängerfreundlichkeit 48/100
devcontainers/features#1730 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Version resolution over unauthenticated git makes feature installs fail hard, with no fallbackEvtl. vergeben @v-Kaniska244 hat das vor 57 Tagen übernommen. Offen
devcontainers/features#1726 · 2 Kommentare · 1 zugewiesene Person ·
Maintainer antworten meist innerhalb von 1 Tag
Alle Issues in devcontainers/features
Ähnliche Issues
-
ai-driven-fuzzing bug claude Minor
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 78/100
linagora/open-bastion#425 ·
Maintainer antworten meist innerhalb von 1 Tag
-
BUG
Schwierigkeit 1/5 1-3 Stunden Anfängerfreundlichkeit 90/100
linuxmint/cinnamon-spices-applets#9223 ·
Maintainer antworten meist innerhalb von 1 Tag
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 62/100
leanprover-community/lean4game#589 ·
Maintainer antworten meist innerhalb von 2 Tagen
-
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 76/100
nolabs-ai/nono-packs#65 ·
-
Screensaver ignores mouse movement — cursor stays invisible until keyboard input or lock/unlockOffen
Schwierigkeit 2/5 1-3 Stunden Anfängerfreundlichkeit 74/100
Maintainer antworten meist innerhalb von 1 Tag