RFC: Proposing a standard and generic method of publishing Python packages

Aberta
  • Algo errado?
#28 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
25/100
Tipo de issue
Funcionalidade
Clareza
Precisa de esclarecimento
Status de atividade
Ativa
Stack de tecnologia
python
Domínio
security

Direção de pesquisa

Start by reviewing the proposed SLSA level 3 risk matrix in the issue and the linked Trivy incident. The issue asks for group review of a generic standard for publishing and consuming Python packages, but does not define its requirements or implementation. Done would mean the group agrees on a PySCG norm that helps projects address the stated risks.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

This is a request for comments, in relation to the following topic that relates to publishing & consuming software in the Python language.

The subject was brought up during our today's meeting, and it has been about how to handle the situation that scanners themselves are problematic, as an example thinking of syft and trivy, the latter of which itself experienced trouble recently [1]. Using an LLM it was possible to narrow down the direction, but obviously this should now be put subject to review in the greater group.

Ultimately, the ask as regards a project like, say, qtop (ref. https://github.com/qtop/qtop) is merely the intent to implement SLSA level 3 against the following risk matrix - there is no desire to endorse any particular tool, merely to show the complementarity of risks and measures:

Image

Ideally, we could have a PySCG norm, that would allow Python projects to position themselves correctly in respect to said risks.

[1] https://www.digitec.ch/en/page/trivy-hack-millions-of-credentials-from-thousands-of-companies-leaked-43485

Linguagem predominante
Python
Estrelas
2
Forks
2
Merge médio
11min
PRs com merge (30d)
2

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de ossf/python-secure-coding-guide

Todas as issues de ossf/python-secure-coding-guide

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.