python: signature verification can never succeed for Python 3.14+
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Aptitud para principiantes
- 52/100
Línea de trabajo
Start in src/python/install.sh around lines 532-591, where the cosign and signature downloads run. Reproduce the curl exit code 2 from -f combined with --fail-with-body, then check the .sigstore URL that python.org serves for 3.14+. Done means the downloads succeed, cosign verify-blob checks the bundle against the signer identity python.org lists, and a failed check stops the build or logs a real error.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Summary
In the python feature (1.8.0, and src/python/install.sh on main), the cosign check for Python 3.14+ always fails, so these versions are always built from source without signature verification. The build continues and logs that this is expected for newly released versions, but it happens for every version.
Causes
-
Invalid curl flags. The cosign and signature downloads (lines 532, 544, 585, 591) pass both
-fand--fail-with-body, which curl rejects with exit code 2. Most of these calls send stderr to/dev/null, and none of them surfaces the real error, so it looks like a failed download.curl -L -f --fail-with-body https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz.crt -o /dev/null # curl: option --fail-with-body: is badly used here # exit code 2Reproduced with curl 8.14.1 (in a dev container built from
mcr.microsoft.com/devcontainers/base:debian) and curl 8.7.1 (macOS). With--fail-with-bodyalone, the same request exits 0. -
Wrong certificate URL. Lines 580-581 look for
.sigand.pem. For 3.14.10, python.org returns 200 for.sig,.crtand.sigstore, and 404 for.pem. Fixing the curl flags alone would still fail at this step. -
Any signer is accepted. The
cosign verify-blobcall uses--certificate-identity-regexp=".*"and--certificate-oidc-issuer-regexp=".*". Even a passing check wouldn't show that the Python release manager signed the file. -
The build continues after a failed check. If verification fails, the script logs a warning and builds the tarball anyway, and there is no checksum check. The warning says this is "expected for newly released versions where cosign signatures are not yet available", which hides the failure.
Impact
Every Python 3.14+ build from source through this feature skips signature verification. The tarball is still downloaded over HTTPS, so this doesn't create an attack by itself, but the protection that replaced PGP for 3.14+ isn't working.
Suggested fix
-
Remove
-ffrom the affected curl calls. -
Verify with the
.sigstorebundle and the signer identity that python.org lists for each release series. This command returnedVerified OKfor 3.14.10 with cosign 3.1.4, and failed when given a different identity:cosign verify-blob \ --bundle Python-3.14.10.tgz.sigstore \ --certificate-identity [email protected] \ --certificate-oidc-issuer https://github.com/login/oauth \ Python-3.14.10.tgz -
Consider failing the build when verification fails, or at least changing the warning so it doesn't describe a failure as expected.
- Lenguaje dominante
- Shell
- Estrellas
- 1.6k
- Forks
- 628
- Merge medio
- 1 d 19 h
- PR fusionados (30 d)
- 5
Preparar el entorno
Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.
- Sin Dockerfile ni archivo de Docker Compose
- Sin plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de devcontainers/features
-
Terraform feature fails to install due to tflint checksumPosiblemente ocupada @v-Kaniska244 la tomó hace 4 días. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
devcontainers/features#1757 · 1 comentario · 1 reacción · 2 asignados ·
Los mantenedores suelen responder en 1 día
-
docker-outside-of-docker: processes started before the entrypoint's `groupmod` keep stale groups and cannot use the socketPosiblemente ocupada Un pull request vinculado a esta issue está abierto o ya se fusionó. Abierto
Dificultad 4/5 3-5 días Aptitud para principiantes 18/100
devcontainers/features#1760 ·
Los mantenedores suelen responder en 1 día
-
Can the onCreateCommand be run background and use the Output tab instead of the Terminal tab?Abierto
Dificultad 4/5 3-5 días Aptitud para principiantes 38/100
devcontainers/features#1754 ·
Los mantenedores suelen responder en 1 día
-
use mise for java feature installation or make sdkman configuable to download JDK from mirrosAbierto
Dificultad 4/5 3-5 días Aptitud para principiantes 48/100
devcontainers/features#1730 ·
Los mantenedores suelen responder en 1 día
-
Version resolution over unauthenticated git makes feature installs fail hard, with no fallbackPosiblemente ocupada @v-Kaniska244 la tomó hace 57 días. Abierto
devcontainers/features#1726 · 2 comentarios · 1 asignado ·
Los mantenedores suelen responder en 1 día
Todos los issues de devcontainers/features
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 62/100
-
Dificultad 1/5 Menos de una hora Aptitud para principiantes 85/100
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
heroku/heroku-buildpack-php#1024 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
openSUSE/rpm-config-SUSE#98 ·
-
Update llmfit to 1.1.20Abiertopackage-update
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
Los mantenedores suelen responder en 1 día