python: signature verification can never succeed for Python 3.14+

オープン
  • 何か問題がありますか？
#1,764 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
52/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
shell
領域
security, tooling

調査の方向性

Start in src/python/install.sh around lines 532-591, where the cosign and signature downloads run. Reproduce the curl exit code 2 from -f combined with --fail-with-body, then check the .sigstore URL that python.org serves for 3.14+. Done means the downloads succeed, cosign verify-blob checks the bundle against the signer identity python.org lists, and a failed check stops the build or logs a real error.

索引モデルが issue の本文から書いたものです。

説明

Summary

In the python feature (1.8.0, and src/python/install.sh on main), the cosign check for Python 3.14+ always fails, so these versions are always built from source without signature verification. The build continues and logs that this is expected for newly released versions, but it happens for every version.

Causes

  1. Invalid curl flags. The cosign and signature downloads (lines 532, 544, 585, 591) pass both -f and --fail-with-body, which curl rejects with exit code 2. Most of these calls send stderr to /dev/null, and none of them surfaces the real error, so it looks like a failed download.

    curl -L -f --fail-with-body https://www.python.org/ftp/python/3.14.10/Python-3.14.10.tgz.crt -o /dev/null
# curl: option --fail-with-body: is badly used here
# exit code 2

    Reproduced with curl 8.14.1 (in a dev container built from mcr.microsoft.com/devcontainers/base:debian) and curl 8.7.1 (macOS). With --fail-with-body alone, the same request exits 0.

  2. Wrong certificate URL. Lines 580-581 look for .sig and .pem. For 3.14.10, python.org returns 200 for .sig, .crt and .sigstore, and 404 for .pem. Fixing the curl flags alone would still fail at this step.

  3. Any signer is accepted. The cosign verify-blob call uses --certificate-identity-regexp=".*" and --certificate-oidc-issuer-regexp=".*". Even a passing check wouldn't show that the Python release manager signed the file.

  4. The build continues after a failed check. If verification fails, the script logs a warning and builds the tarball anyway, and there is no checksum check. The warning says this is "expected for newly released versions where cosign signatures are not yet available", which hides the failure.

Impact

Every Python 3.14+ build from source through this feature skips signature verification. The tarball is still downloaded over HTTPS, so this doesn't create an attack by itself, but the protection that replaced PGP for 3.14+ isn't working.

Suggested fix

  1. Remove -f from the affected curl calls.

  2. Verify with the .sigstore bundle and the signer identity that python.org lists for each release series. This command returned Verified OK for 3.14.10 with cosign 3.1.4, and failed when given a different identity:

    cosign verify-blob \
  --bundle Python-3.14.10.tgz.sigstore \
  --certificate-identity [email protected] \
  --certificate-oidc-issuer https://github.com/login/oauth \
  Python-3.14.10.tgz

  3. Consider failing the build when verification fails, or at least changing the warning so it doesn't describe a failure as expected.

主要言語
Shell
スター
1.6k
フォーク
628
平均マージ
1日 19時間
マージ済み PR（30日）
5

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

devcontainers/features のほかの issue

devcontainers/features の issue をすべて見る

似ている issue

Shell/Bash の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。