pySCG: New Python specific rule that promotes signed software, CWE-494: Download of Code Without Integrity Check

Aberta
  • Algo errado?
#11 2 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
48/100
Tipo de issue
Documentação
Clareza
Razoavelmente clara
Status de atividade
Pouca atividade
Stack de tecnologia
python
Domínio
security

Direção de pesquisa

Start by reading the linked CWE-494 and Python.org Sigstore information, then review the Python Packaging User Guide section on signed wheel files. Draft a Python-specific rule explaining the risk of downloading code without integrity checks and how to verify already signed software; decide whether guidance on creating signatures belongs in a separate rule. Done means the rule clearly covers verification before software is used.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Supply chain attacks are the most efficient attack vector for malicious actors. We need a rule that outlines the issue, aka lack of software verification, and showcase how to at least verify already signed software.

CWE-494: Download of Code Without Integrity Check

Own signatures might require another rule to avoid overloading this one.

Python modules are frequently hosted on mirrors with unknown trust.
Python.org provides a solution via Sigstore since Python 3.10.7
Sigstore information
it is not very well know amongst coders.

Python allows to sign wheel files distribution format — Python Packaging User Guide

https://packaging.python.org/en/latest/specifications/binary-distribution-format/#binary-distribution-format

some text:
Allowing only signed code can prevent injection of malicious or untested code running on production servers. Integrity and authenticity must be verified prior to using code. Authorization must not be assumed but can be based on verifiable individual identities or attributes of signed software.

Linguagem predominante
Python
Estrelas
2
Forks
2
Merge médio
11min
PRs com merge (30d)
2

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de ossf/python-secure-coding-guide

Todas as issues de ossf/python-secure-coding-guide

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.