{"id":120574,"date":"2024-11-15T01:09:07","date_gmt":"2024-11-14T23:09:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov"},"modified":"2024-11-15T01:09:07","modified_gmt":"2024-11-14T23:09:08","slug":"katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","title":{"rendered":"Katalog PyPI zavedl nov\u00fd syst\u00e9m ov\u011b\u0159ov\u00e1n\u00ed bal\u00ed\u010dk\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i repozit\u00e1\u0159e Python bal\u00ed\u010dk\u016f PyPI (Python Package Index) ozn\u00e1mili zaveden\u00ed podpory digit\u00e1ln\u00edho certifika\u010dn\u00edho mechanismu pro ov\u011b\u0159ov\u00e1n\u00ed pravosti publikovan\u00fdch bal\u00ed\u010dk\u016f, kter\u00fd nahradil verifikaci pomoc\u00ed PGP podpis\u016f. Kl\u00ed\u010dov\u00fdm rozd\u00edlem certifikace je, \u017ee publikaci bal\u00ed\u010dku potvrzuje nikoli v\u00fdvoj\u00e1\u0159, ale t\u0159et\u00ed strana (adres\u00e1\u0159 bal\u00ed\u010dk\u016f) po ov\u011b\u0159en\u00ed pravosti publikace prost\u0159ednictv\u00edm extern\u00edho poskytovatele OpenID Connect (nap\u0159\u00edklad po ov\u011b\u0159en\u00ed, \u017ee publikovan\u00fd bal\u00ed\u010dek souvis\u00ed se spojen\u00fdm repozit\u00e1\u0159em na GitHubu nebo GitLab). <\/p>\n

Syst\u00e9m certifikace eliminuje nedostatky spojen\u00e9 s mechanismem ov\u011b\u0159ov\u00e1n\u00ed pomoc\u00ed PGP podpis\u016f, kter\u00fd byl d\u0159\u00edve na PyPI ozna\u010den za zastaral\u00fd. Toto \u0159e\u0161en\u00ed bylo p\u0159ijato kv\u016fli probl\u00e9m\u016fm s ov\u011b\u0159en\u00edm p\u0159\u00edslu\u0161nosti v\u00fdvoj\u00e1\u0159\u016fm k ve\u0159ejn\u00fdm PGP kl\u00ed\u010d\u016fm pou\u017e\u00edvan\u00fdm k ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f \u2014 z 1069 PGP kl\u00ed\u010d\u016f pou\u017eit\u00fdch od roku 2020 pro vytv\u00e1\u0159en\u00ed podpis\u016f v PyPI, 29% ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f chyb\u011blo na velk\u00fdch ve\u0159ejn\u00fdch. serverech<\/a> P\u0159itom potvrzen\u00fdch 36% PGP kl\u00ed\u010d\u016f pokr\u00fdvalo pouze 0.3% ze v\u0161ech podepsan\u00fdch soubor\u016f. <\/p>\n

V nov\u00e9m syst\u00e9mu se podpisy pou\u017e\u00edvan\u00e9 k certifikaci bal\u00ed\u010dk\u016f vytv\u00e1\u0159ej\u00ed pomoc\u00ed kr\u00e1tkodob\u00fdch efem\u00e9rn\u00edch kl\u00ed\u010d\u016f, generovan\u00fdch na z\u00e1klad\u011b opr\u00e1vn\u011bn\u00ed potvrzen\u00fdch poskytovateli OpenID Connect. V okam\u017eiku generov\u00e1n\u00ed kl\u00ed\u010d\u016f pot\u0159ebn\u00fdch k vytvo\u0159en\u00ed digit\u00e1ln\u00edho podpisu se v\u00fdvoj\u00e1\u0159 identifikuje prost\u0159ednictv\u00edm poskytovatele OpenID, kter\u00fd potvrzuje jeho spojen\u00ed s hlavn\u00edm projektem. Infrastruktura pro digit\u00e1ln\u00ed certifikaci byla vybudov\u00e1na za pomoc\u00ed syst\u00e9mu Sigstore a n\u00e1stroje in-toto Attestation Framework. <\/p>\n

Mezi v\u00fdhody certifikace pat\u0159\u00ed absence vazby na st\u00e1l\u00e9 PGP kl\u00ed\u010de \u2014 ztr\u00e1ta nebo kompromitace soukrom\u00e9ho kl\u00ed\u010de ni\u010d\u00ed d\u016fv\u011bru k podpis\u016fm vytvo\u0159en\u00fdm na jeho z\u00e1klad\u011b, zat\u00edmco p\u0159i certifikaci je podpis generov\u00e1n v\u00e1zan\u00fd na token, kter\u00fd potvrzuje opr\u00e1vn\u011bn\u00ed v okam\u017eiku um\u00edst\u011bn\u00ed bal\u00ed\u010dku a vazbu bal\u00ed\u010dku s hlavn\u00edm repozit\u00e1\u0159em k\u00f3du. Nap\u0159\u00edklad p\u0159i publikaci bal\u00ed\u010dku p\u0159ipraven\u00e9ho prost\u0159ednictv\u00edm GitHub Action certifikace ur\u010duje ov\u011b\u0159itelnou a potvrzenou vazbu mezi umis\u0165ovan\u00fdm souborem na PyPI, repozit\u00e1\u0159em, workflow procesem a hashem commitu, na jeho\u017e z\u00e1klad\u011b byl bal\u00ed\u010dek vytvo\u0159en.

\"Katalog<\/center> <\/p>\n

Pro sledov\u00e1n\u00ed autenticity kl\u00ed\u010d\u016f a odhalov\u00e1n\u00ed mo\u017en\u00fdch kompromitac\u00ed je pou\u017eit ve\u0159ejn\u00fd centralizovan\u00fd log pro generov\u00e1n\u00ed bal\u00ed\u010dk\u016f projekt\u016f a samotn\u00e9ho PyPI, aby se zajistila integrita a ochrana p\u0159ed zp\u011btn\u00fdm zkreslen\u00edm dat, ve kter\u00e9 je vyu\u017eit syst\u00e9m \u201eMerkle Tree\u201c (Merkle Tree, ka\u017ed\u00e1 v\u011btev ov\u011b\u0159uje v\u0161echny pod\u0159\u00edzen\u00e9 v\u011btve a uzly d\u00edky stromov\u00e9mu hashov\u00e1n\u00ed). <\/p>\n

D\u00e1le bychom m\u011bli zm\u00ednit odhalen\u00ed \u0161kodliv\u00e9ho bal\u00ed\u010dku \u201efabrice\u201c v katalogu PyPI, kter\u00fd se maskoval pomoc\u00ed type squattingu (p\u0159i\u0159azen\u00ed podobn\u00fdch n\u00e1zv\u016f, kter\u00e9 se li\u0161\u00ed jednotliv\u00fdmi znaky, nap\u0159\u00edklad exampl m\u00edsto example, djangoo m\u00edsto django, pyhton m\u00edsto python atd.) pod popul\u00e1rn\u00ed knihovnu \u201efabric\u201c, kter\u00e1 m\u00e1 201 milion\u016f sta\u017een\u00ed (7 milion\u016f sta\u017een\u00ed za minul\u00fd m\u011bs\u00edc). \u0160kodliv\u00fd bal\u00ed\u010dek z\u016fstal nepov\u0161imnut od roku 2021 a od t\u00e9 doby byl sta\u017een v\u00edce ne\u017e 37 tis\u00edckr\u00e1t. <\/p>\n

Bal\u00ed\u010dek \u201efabrice\u201c opakoval z\u00e1kladn\u00ed funk\u010dnost p\u016fvodn\u00ed knihovny a nav\u00edc obsahoval k\u00f3d pro identifikaci a odes\u00edl\u00e1n\u00ed extern\u00edm host\u016fm kl\u00ed\u010d\u016f pro p\u0159\u00edstup k AWS (Amazon Web Services), instalaci zadn\u00edho vchodu a vykon\u00e1v\u00e1n\u00ed ur\u010dit\u00fdch skript\u016f. Aktivace \u0161kodliv\u00fdch komponent se prov\u00e1d\u011bla v Linuxu a Windows. V Linuxu byly souvisej\u00edc\u00ed s \u0161kodlivou aktivitou soubory nahr\u00e1v\u00e1ny do katalogu ~\/ .local \/ bin \/ vscode.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0448\u043b\u0430 \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PGP-\u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439. \u041a\u043b\u044e\u0447\u0435\u0432\u044b\u043c \u043e\u0442\u043b\u0438\u0447\u0438\u0435\u043c \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430 \u0437\u0430\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c, \u0430 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043b\u0438\u0446\u043e\u043c (\u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432) \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0441\u0442\u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 OpenID Connect (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Katalog PyPI zavedl nov\u00fd syst\u00e9m ov\u011b\u0159ov\u00e1n\u00ed bal\u00ed\u010dk\u016f | ProHoster","description":"V\u00fdvoj\u00e1\u0159i repozit\u00e1\u0159e Python bal\u00ed\u010dk\u016f PyPI (Python Package Index) ozn\u00e1mili zaveden\u00ed podpory mechanismu digit\u00e1ln\u00ed certifikace pro ov\u011b\u0159ov\u00e1n\u00ed pravosti publikovan\u00fdch bal\u00ed\u010dk\u016f, kter\u00e1 nahradila p\u0159edchoz\u00ed verifika\u010dn\u00ed proces.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u043b\u043e\u0433 PyPI \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0448\u043b\u0430 \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-14T23:09:08+00:00","article:modified_time":"2024-11-14T23:09:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:02:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:02:22","updated":"2026-01-23 08:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=120574"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120574\/revisions"}],"predecessor-version":[{"id":164444,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/120574\/revisions\/164444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/120575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=120574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=120574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=120574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}