{"id":108047,"date":"2023-04-23T12:48:18","date_gmt":"2023-04-23T10:48:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=108047"},"modified":"2023-04-24T10:41:12","modified_gmt":"2023-04-24T08:41:12","slug":"v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","title":{"rendered":"PyPI-s on rakendatud v\u00f5imalus pakette avaldada, ilma et oleks vaja paroole ja API tokeneid.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python pakettide PyPI (Python Package Index) hoidlas on n\u00fc\u00fcd saadaval uus kaitstud meetod pakettide avaldamiseks, mis v\u00f5imaldab v\u00e4ltida salajaste paroolide ja API juurde p\u00e4\u00e4su tokenite s\u00e4ilitamist v\u00e4listes s\u00fcsteemides (nt GitHub Actions). Uue autentimismeetodi nimi on 'Trusted Publishers' ja see on loodud selleks, et lahendada probleem pahatahtlike v\u00e4rskenduste avaldamisel, mis tulenevad v\u00e4listes s\u00fcsteemides toimunud r\u00fcnnakutest, kus kurjategijad saavad k\u00e4tte ettem\u00e4\u00e4ratud paroolid v\u00f5i tokenid. <\/p>\n

Uus autentimismeetod p\u00f5hineb OpenID Connect (OIDC) standardil, mis eeldab ajaliselt piiratud autentimiskoodide kasutamist, mida vahetavad v\u00e4lishaerverid ja PyPI kataloog paketi avaldamise tegevuse kinnitamiseks, asendades traditsioonilised sisselogimise\/parooli kombinatsioonid v\u00f5i k\u00e4sitsi genereeritud p\u00fcsivad API juurde p\u00e4\u00e4su tokenid. 'Trusted Publishers' mehhanismi rakendamine on juba teostatud GitHub Actions'is t\u00f6\u00f6tavate k\u00e4itlejate jaoks. Tulevikus on oodata 'Trusted Publishers' toe rakendamist ka teistele v\u00e4listel teenustele. <\/p>\n

Saadetavad paketid saavad PyPI-s m\u00e4\u00e4rata usaldusv\u00e4\u00e4rsusm\u00e4rkmeid, mis on seotud v\u00e4liste OpenID (IdP, OpenID Connect Identity Provider) pakkujate poolt esitatud identifikaatoritega, mida v\u00e4line teenus kasutab PyPI-lt l\u00fchiajaliste tokenite k\u00fcsimiseks. Generaatorid OpenID Connect tokenid kinnitavad seose projekti ja t\u00f6\u00f6tluse vahel, v\u00f5imaldades PyPI-l teostada t\u00e4iendavat metaandmete valideerimist, n\u00e4iteks kontrollida, et avaldatav paket vastab teatud hoidlatele. Tokenid ei salvestata, need on seotud kindlate API-dega ja l\u00f5petavad automaatselt kehtivuse p\u00e4rast l\u00fchikese eluea m\u00f6\u00f6dumist. <\/p>\n

Lisaks v\u00f5ib m\u00e4rkida, et Sonatype'i ettev\u00f5tte aruanne t\u00f5i v\u00e4lja 6933 pahatahtlikku paketti PyPI kataloogis, mis tuvastati m\u00e4rtsis 2023. Alates 2019. aastast on PyPI-s tuvastatud \u00fcle 115 000 pahatahtliku paketi. Suur osa pahatahtlikest pakettidest peidab end populaarsete teekide all, kasutades nimekaotust (sarnaste nimede m\u00e4\u00e4ramine, mis erinevad \u00fcksikute s\u00fcmbolite poolest, n\u00e4iteks exampl asemel example, djangoo asemel django, pyhton asemel python jne) \u2014 kurjategijad loodavad t\u00e4helepanematutele kasutajatele, kes on teinud tr\u00fcki v\u00f5i ei ole nimede vahelisi erinevusi otsingul m\u00e4rganud. Pahatahtlikud tegevused piirduvad tavaliselt konfidentsiaalsete andmete edastamisega, mis on leitud lokaalsest s\u00fcsteemist paroolidega, juurdep\u00e4\u00e4sukoodide, kr\u00fcptoraha rahakottide, tokenite, sessioonik\u00fcpsiste ja muu konfidentsiaalse teabe m\u00e4\u00e4ramise kaudu.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 GitHub Actions) \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ‘Trusted Publishers’ \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108047","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI-s on n\u00fc\u00fcd v\u00f5imalik avaldada pakette ilma paroolide ja API tokenitega sidumata | ProHoster","description":"Python pakettide hoidlas PyPI (Python Package Index) on n\u00fc\u00fcd saadaval uus turvaline meetod pakettide avaldamiseks, mis v\u00f5imaldab v\u00e4ltida v\u00e4liste s\u00fcsteemide (nt.) salvestamise vajadust.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u0430\u0440\u043e\u043b\u044f\u043c \u0438 \u0442\u043e\u043a\u0435\u043d\u0430\u043c API | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-23T10:48:18+00:00","article:modified_time":"2023-04-24T08:41:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108047"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108047\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}