{"id":120574,"date":"2024-11-15T01:09:07","date_gmt":"2024-11-14T23:09:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov"},"modified":"2024-11-15T01:09:07","modified_gmt":"2024-11-14T23:09:08","slug":"katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","title":{"rendered":"PyPI kataloog on sisse viinud uue pakettide autentimise s\u00fcsteemi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Python paketite PyPI (Python Package Index) hoidlate arendajad on teatanud digitaalsete t\u00f5enduss\u00fcsteemide toetamist, et kontrollida avaldatud paketide autentsust, millele eelnes PGP allkirjade kasutamine. T\u00f5endamise peamine erinevus seisneb selles, et paketi avaldab mitte arendaja, vaid kolmas osapool (pakettide kataloog) p\u00e4rast avaldamise usaldusv\u00e4\u00e4rsuse kinnitamist v\u00e4lise OpenID Connect pakkuja (n\u00e4iteks p\u00e4rast selle kontrollimist, et avaldatud pakk vastab seotud hoidlatele GitHubis v\u00f5i GitLabis). <\/p>\n

Atesteerimiss\u00fcsteem k\u00f5rvaldab PGP-allkirjade valideerimise mehhanismi puudused, mis oli varem PyPI-s aegunud. See lahendus on vastu v\u00f5etud probleemide t\u00f5ttu avatud PGP-v\u00f5tmete kontrollimisel, mida on kasutatud digitaalsete allkirjade kontrollimiseks \u2014 1069 PGP-v\u00f5tmest, mis on alates 2020. aastast olnud kasutusel allkirjade genereerimiseks PyPI-s, 29% avalikest v\u00f5tmetest ei olnud suurtes avalikes registrites saadaval. serverites<\/a> 35% v\u00f5tmeid ei \u00f5nnestunud auditi k\u00e4igus kinnitada. Samal ajal katab kinnitatud 36% PGP v\u00f5tmeid vaid 0.3% k\u00f5ikidest allkirjastatud failidest. <\/p>\n

Uues s\u00fcsteemis, mida kasutatakse pakettide t\u00f5endamiseks, luuakse allkirjad l\u00fchikeste eluiga ephemeral v\u00f5tmete abil, mis genereeritakse OpenID Connect pakkujate kinnitatud volituste alusel. V\u00f5tmete genereerimise ajal, mis on vajalikud digitaalsete allkirjade loomiseks, tuvastab arendaja end OpenID pakkuja kaudu, kes kinnitab tema seose p\u00f5hiprojektiga. Digitaalsete t\u00f5endite infrastruktuur on \u00fcles ehitatud Sigstore s\u00fcsteemi ja in-toto T\u00f5endamise Raamistiku t\u00f6\u00f6riistade abil. <\/p>\n

Atesteerimise eeliste hulka kuulub p\u00fcsivale PGP-v\u00f5tmele sidumise puudumine \u2014 kadumine v\u00f5i privaatv\u00f5tme kompromiteerimine h\u00e4vitab usalduse selle alusel loodud allkirjade vastu, samas kui atesteerimise korral genereeritakse allkiri, mis on seotud token'i kaudu, kinnitades \u00f5igusi paketi \u00fcleslaadimise hetkeks ja seose paketi ja p\u00f5hikoodireposiidi vahel. N\u00e4iteks paketi avaldamisel, mis on ette valmistatud l\u00e4bi GitHub Action'i, m\u00e4\u00e4ratleb atesteerimine kontrollitava ja kinnitatud seose PyPI-s \u00fcleslaaditud faili, registri, t\u00f6\u00f6voo protsessi ja h\u00e4shed, mille alusel pakett loodi.

\"PyPI<\/center> <\/p>\n

Pakettide projektide ja PyPI enda v\u00f5tmete autentsuse j\u00e4lgimiseks ning v\u00f5imalike kompromiteerimiste tuvastamiseks kasutatakse avalikku tsentraliseeritud logi, et tagada andmete terviklikkuse ja tagasil\u00fckkamise kaitse, kus rakendatakse struktuuri \u201eMerkle puu\u201c (Merkle Tree, iga haru kinnitab k\u00f5iki madalamaid harusid ja s\u00f5lmi t\u00e4nu puustruktuurile, mis p\u00f5hineb h\u0161eshimisel). <\/p>\n

Lisaks v\u00f5ib nimetada PyPI kataloogis tuvastatud pahatahtlikku paketti \u201efabrice\u201c, mis peitis end t\u00fc\u00fcpvigade (sarnaste nimede m\u00e4\u00e4ramine, mis erinevad \u00fcksikute s\u00fcmbolite poolest, n\u00e4iteks exampl asemel example, djangoo asemel django, pyhton asemel python jne) abil, maskeerides end populaarsesse teeki \u201efabric\u201c, millel on 201 miljonit allalaadimist (7 miljonit allalaadimist eelmisel kuul). Pahatahtlik pakett j\u00e4i m\u00e4rkamatuks alates 2021. aastast ja on sellest ajast saadik alla laaditud \u00fcle 37 tuhande korra. <\/p>\n

Pakett «fabrice» kordas algse raamatukogude p\u00f5hifunktsioone ja sisaldas t\u00e4iendavalt koodi AWS (Amazon Web Services) juurdep\u00e4\u00e4suv\u00f5tmete tuvastamiseks ja edastamiseks v\u00e4listele hostidele, tagaukse seadmiseks ja teatud skriptide k\u00e4ivitamiseks. Kahjulike komponentide aktiveerimine toimus Linuxis ja Windowsis. Linuxis laaditi kahjuliku tegevusega seotud failid katalooge ~\/.local\/bin\/vscode.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0448\u043b\u0430 \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PGP-\u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439. \u041a\u043b\u044e\u0447\u0435\u0432\u044b\u043c \u043e\u0442\u043b\u0438\u0447\u0438\u0435\u043c \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430 \u0437\u0430\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c, \u0430 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043b\u0438\u0446\u043e\u043c (\u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432) \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0441\u0442\u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 OpenID Connect (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Kataloog PyPI tutvustas uut pakettide ehtsuse kontrollimise s\u00fcsteemi | ProHoster","description":"Python-pakettide repositooriumi PyPI (Python Package Index) arendajad teatasid, et nad on rakendanud digitaalsete sertifitseerimise mehhanismi toe, et kontrollida avaldatud pakettide ehtsust, mis asendab varasemat kontrollimise s\u00fcsteemi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u043b\u043e\u0433 PyPI \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0448\u043b\u0430 \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-14T23:09:08+00:00","article:modified_time":"2024-11-14T23:09:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:02:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:02:22","updated":"2026-01-23 08:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120574"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120574\/revisions"}],"predecessor-version":[{"id":164444,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120574\/revisions\/164444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/120575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}