RFC: Proposing a standard and generic method of publishing Python packages

Ouverte
  • Quelque chose ne va pas ?
#28 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
25/100
Type d'issue
Fonctionnalité
Clarté
À clarifier
Activité
Active
Stack technique
python
Domaine
security

Piste de recherche

Start by reviewing the proposed SLSA level 3 risk matrix in the issue and the linked Trivy incident. The issue asks for group review of a generic standard for publishing and consuming Python packages, but does not define its requirements or implementation. Done would mean the group agrees on a PySCG norm that helps projects address the stated risks.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

This is a request for comments, in relation to the following topic that relates to publishing & consuming software in the Python language.

The subject was brought up during our today's meeting, and it has been about how to handle the situation that scanners themselves are problematic, as an example thinking of syft and trivy, the latter of which itself experienced trouble recently [1]. Using an LLM it was possible to narrow down the direction, but obviously this should now be put subject to review in the greater group.

Ultimately, the ask as regards a project like, say, qtop (ref. https://github.com/qtop/qtop) is merely the intent to implement SLSA level 3 against the following risk matrix - there is no desire to endorse any particular tool, merely to show the complementarity of risks and measures:

Image

Ideally, we could have a PySCG norm, that would allow Python projects to position themselves correctly in respect to said risks.

[1] https://www.digitec.ch/en/page/trivy-hack-millions-of-credentials-from-thousands-of-companies-leaked-43485

Langage dominant
Python
Étoiles
2
Forks
2
Merge moyen
11 min
PR mergées (30 j)
2

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de ossf/python-secure-coding-guide

Toutes les issues de ossf/python-secure-coding-guide

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.