{"id":108047,"date":"2023-04-23T12:48:18","date_gmt":"2023-04-23T10:48:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=108047"},"modified":"2023-04-24T10:41:12","modified_gmt":"2023-04-24T08:41:12","slug":"v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","title":{"rendered":"PyPI-s on rakendatud v\u00f5imalus avaldada pakette ilma paroolide ja API tokenitega sidumata.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pythoni pakettide hoidlas PyPI (Python Package Index) on n\u00fc\u00fcd saadaval uus kaitstud meetod pakettide avaldamiseks, mis v\u00f5imaldab v\u00e4ltida v\u00e4liste s\u00fcsteemide (nt GitHub Actions) fikseeritud paroole ja API p\u00e4\u00e4sukoode. Uus autentimismeetod kannab nime 'Trusted Publishers' ja on loodud selleks, et lahendada probleem kahjulike uuenduste avaldamisega, mis tulenevad v\u00e4liste s\u00fcsteemide kompromiteerimisest ja eelnevalt m\u00e4\u00e4ratud paroolide v\u00f5i tokenite sattumisest kurjategijate k\u00e4tte. <\/p>\n

Uus autentimismeetod p\u00f5hineb OpenID Connect (OIDC) standardi kasutamisel, mis h\u00f5lmab ajaliselt piiratud kehtivusega autentimistokenite vahetamist v\u00e4liste teenuste ja PyPI katalooge vahel paketi avaldamise operatsiooni kinnitamiseks, selle asemel, et kasutada traditsioonilisi kasutajanime\/parooli v\u00f5i k\u00e4sitsi genereeritud p\u00fcsivaid API juurdep\u00e4\u00e4sukoode. 'Trusted Publishers' mehhanismi rakendamine on juba teostatud GitHub Actions'it k\u00e4itavate t\u00f6\u00f6tlejate jaoks. Tulevikus oodatakse Trusted Publishers'i toe rakendamist ka teistele v\u00e4listest teenustest. <\/p>\n

Saatepaketid saavad PyPIs usaldusm\u00e4rgid m\u00e4\u00e4rata OpenID (IdP, OpenID Connect Identity Provider) v\u00e4listelt teenusepakkujatelt, mida v\u00e4line teenus kasutab, et k\u00fcsida PyPItelt l\u00fchiajalisi token'e. Generaatorid OpenID Connect token'id kinnitavad seose projekti ja t\u00f6\u00f6tleva s\u00fcsteemi vahel, mis v\u00f5imaldab PyPI-l teha t\u00e4iendavaid metainfo verifitseerimisi, n\u00e4iteks kontrollida, et avaldatud pakett vastab kindlale hoidla. Token'id ei salvestata, need on seotud teatud API-dega ja l\u00f5petavad automaatselt kehtivuse p\u00e4rast l\u00fchikese kehtivusaja l\u00f5ppu. <\/p>\n

Lisaks v\u00f5ib mainida ettev\u00f5tte Sonatype aruannet, milles on teavet selle kohta, et 2023. aasta m\u00e4rtsis tuvastati 6933 kahjulikku paketti PyPI kataloogis. Alates 2019. aastast on PyPI-s tuvastatud kahjulike pakettide arv \u00fcletanud 115 000. Suur osa kahjulikest pakettidest maskeeritakse populaarsete raamatukogude all, kasutades t\u00fc\u00fcpide vahendamist (sarnaste nimede m\u00e4\u00e4ramine, mis erinevad teatud s\u00fcmbolite poolest, n\u00e4iteks exampl asemel example, djangoo asemel django, pyhton asemel python jne) - kurjategijad loodavad t\u00e4helepanematute kasutajate peale, kes teevad tr\u00fckivigu v\u00f5i ei m\u00e4rka nimede erinevusi otsingute ajal. Kahjulik tegevus keskendub tavaliselt konfidentsiaalsete andmete saatmisele, mis leiti kohalikest s\u00fcsteemidest t\u00fc\u00fcpiliste failide tuvastamise kaudu, mis sisaldavad paroole, juurdep\u00e4\u00e4sukoode, kr\u00fcptorahakotte, tokenite, sessiooni k\u00fcpsiseid ja muud konfidentsiaalset teavet.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 GitHub Actions) \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ‘Trusted Publishers’ \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108047","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PyPI-s on v\u00f5imalik avaldada pakette ilma paroolide ja API-tokeniteni | ProHoster","description":"Python pakettide repositooriumis PyPI (Python Package Index) on n\u00fc\u00fcd saadaval uus turvaline pakettide avaldamise meetod, mis v\u00f5imaldab v\u00e4ltida v\u00e4liste s\u00fcsteemide (nt GitHub Actions) fikseeritud paroole ja API-juurdep\u00e4\u00e4su tokenite salvestamist. Uus autentimismeetod kannab nime 'Trusted Publishers' ja on loodud selleks, et lahendada probleem pahatahtlike uuenduste avaldamisega, mis tulenevad v\u00e4liste s\u00fcsteemide kompromiteerimisest ja","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u0430\u0440\u043e\u043b\u044f\u043c \u0438 \u0442\u043e\u043a\u0435\u043d\u0430\u043c API | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 GitHub Actions) \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 'Trusted Publishers' \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-23T10:48:18+00:00","article:modified_time":"2023-04-24T08:41:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=108047"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/108047\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=108047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=108047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=108047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}