RFC: Proposing a standard and generic method of publishing Python packages

Offen
  • Stimmt etwas nicht?
#28 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
25/100
Issue-Typ
Feature
Klarheit
Muss geklärt werden
Aktivitätsstatus
Aktiv
Tech-Stack
python
Bereich
security

Rechercherichtung

Start by reviewing the proposed SLSA level 3 risk matrix in the issue and the linked Trivy incident. The issue asks for group review of a generic standard for publishing and consuming Python packages, but does not define its requirements or implementation. Done would mean the group agrees on a PySCG norm that helps projects address the stated risks.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

This is a request for comments, in relation to the following topic that relates to publishing & consuming software in the Python language.

The subject was brought up during our today's meeting, and it has been about how to handle the situation that scanners themselves are problematic, as an example thinking of syft and trivy, the latter of which itself experienced trouble recently [1]. Using an LLM it was possible to narrow down the direction, but obviously this should now be put subject to review in the greater group.

Ultimately, the ask as regards a project like, say, qtop (ref. https://github.com/qtop/qtop) is merely the intent to implement SLSA level 3 against the following risk matrix - there is no desire to endorse any particular tool, merely to show the complementarity of risks and measures:

Image

Ideally, we could have a PySCG norm, that would allow Python projects to position themselves correctly in respect to said risks.

[1] https://www.digitec.ch/en/page/trivy-hack-millions-of-credentials-from-thousands-of-companies-leaked-43485

Vorherrschende Sprache
Python
Sterne
2
Forks
2
Ø Merge
11 Min.
Gemergte PRs (30 T.)
2

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus ossf/python-secure-coding-guide

Alle Issues in ossf/python-secure-coding-guide

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.