Work in Progress: Implementing PEP 458 to Secure PyPI downloads
- Room:
- Liffey B
- Start (Dublin time):
- Start (your time):
- Duration:
- 30 minutes
Abstract
PEP 458 uses cryptographic signing on PyPI to protect Python packages against attackers. In this talk we will share our lessons learned from the ongoing implementation work in PyPI/Warehouse with the Python community. How does PEP 458 work and what is TUF? What protection can it offer now and what does it enable in the future? And how am I affected as a Python developer and as a user?
TalkSecurity
Description
Attacks on software repositories are extremely common and can have a vast impact. A single successful compromise of the content distribution infrastructure can affect millions of users, voluntarily installing the infected packages.
PEP 458 was designed to protect PyPI against a variety of possible attacks on PyPIs own content distribution network and PyPI mirrors, while giving administrators a mechanism to recover from a compromise if it happens. In addition, PEP 458 is a fundamental stepping stone for more advanced protection described in PEP 480.
Both PEP 458 and 480 implement a specification called "The Update Framework" (TUF), which introduces a series of roles, keys and metadata formats that are published along with the packages they protect, and can be verified by a client software such as pip.
Over the past couple of months we have made an effort to integrate the latest version of the Python TUF reference implementation with PyPI/Warehouse (see draft PR).
In this talk we will give an introduction to PEP 458 and TUF, how it works and what it is good for. We will report from the work-in-progress integration with Warehouse, what challenges we face and how Python developer and user workflows are affected, as well as an expected timeline for the integration. And last but not least, we want to give an outlook of what comes after PEP 458, that is full developer-to-user end-to-end protection of Python packages as described by PEP 480.
With our talk we also hope to spark interest in software supply chain security and to encourage the community to get involved by reviewing, commenting and contributing to the PEP 458 and PEP 480 integration efforts.