{"id":120574,"date":"2024-11-15T01:09:07","date_gmt":"2024-11-14T23:09:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov"},"modified":"2024-11-15T01:09:07","modified_gmt":"2024-11-14T23:09:08","slug":"katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","title":{"rendered":"Katalog PyPI uveo je novi sustav provjere autenti\u010dnosti paketa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Razvija\u010di repozitorija Python-paketa PyPI (Python Package Index) najavili su implementaciju podr\u0161ke za mehanizam digitalne atestacije za verifikaciju autenti\u010dnosti objavljenih paketa, koji je zamijenio verifikaciju kori\u0161tenjem PGP potpisa. Klju\u010dna razlika atestacije je u tome \u0161to objavu paketa potvr\u0111uje ne razvija\u010d, ve\u0107 tre\u0107a strana (katalog paketa) nakon verifikacije autenti\u010dnosti objave putem vanjskog pru\u017eatelja OpenID Connect (na primjer, nakon provjere da se objavljeni paket odnosi na povezani repozitorij na GitHubu ili GitLabu). <\/p>\n

Sustav certificiranja uklanja nedostatke karakteristi\u010dne za mehanizam provjere putem PGP-potpisivanja, koji je ranije bio progla\u0161en zastarjelim u PyPI. Ovo rje\u0161enje usvojeno je zbog problema s provjerom pripadnosti razvojnim otvorenim PGP-klju\u010deva koji se koriste za provjeru digitalnih potpisa \u2014 od 1069 PGP-klju\u010deva kori\u0161tenih od 2020. godine za formiranje potpisa u PyPI, 29% otvorenih klju\u010deva nije bilo dostupno na velikim javnim poslu\u017eiteljima<\/a> klju\u010deva, a 35% klju\u010deva se nije moglo potvrditi tokom audita. Potvr\u0111enih 36% PGP klju\u010deva pokrivalo je samo 0.3% od svih potpisanih datoteka. <\/p>\n

U novom sistemu, potpisi kori\u0161teni za atestaciju paketa kreiraju se koriste\u0107i kratkodnevne efemerne klju\u010deve, generirane na osnovu ovlasti koje potvr\u0111uju pru\u017eatelji OpenID Connect. U trenutku generiranja klju\u010deva potrebnih za stvaranje digitalnog potpisa, razvija\u010d se identificira putem pru\u017eatelja OpenID, koji potvr\u0111uje njegovu povezanost s glavnim projektom. Infrastruktura za digitalnu atestaciju izgra\u0111ena je pomo\u0107u sistema Sigstore i alata in-toto Attestation Framework. <\/p>\n

Me\u0111u prednostima certificiranja isti\u010de se odsustvo vezanosti za stalne PGP-klju\u010deve \u2014 gubitak ili kompromitacija privatnog klju\u010da uni\u0161tava povjerenje u potpise temeljene na njemu, dok se prilikom certificiranja potpis formira u vezi s tokenom koji potvr\u0111uje ovlasti u trenutku objavljivanja paketa i povezanost paketa s glavnim repozitorijem koda. Na primjer, prilikom objavljivanja paketa pripremljenog putem GitHub Action, certificiranje odre\u0111uje provjerljivu i potvr\u0111enu povezanost izme\u0111u datoteke smje\u0161tene u PyPI, repozitorija, workflow-procesa i he\u0161a commita na osnovu kojeg je paket formiran.

\"Katalog<\/center> <\/p>\n

Za pra\u0107enje autenti\u010dnosti klju\u010deva i otkrivanje mogu\u0107ih kompromitacija, formiraju\u0107i pakete projekata i samog PyPI, koristi se javni centralizirani log, radi osiguravanja cjelovitosti i za\u0161tite od retroaktivnog iskrivljavanja podataka u kojem je uklju\u010dena struktura \u201eMerkleovo stablo\u201d (Merkle Tree, svaka grana provjerava sve donje grane i \u010dvorove zahvaljuju\u0107i stablo-hashiranju). <\/p>\n

Dodatno se mo\u017ee istaknuti otkrivanje zlonamjernog paketa u katalogu PyPI pod nazivom \u201efabrice\u201d, koji se pomo\u0107u type-squattinga (davanje sli\u010dnih imena koja se razlikuju po pojedinim znakovima, na primjer, exampl umjesto example, djangoo umjesto django, pyhton umjesto python itd.) maskirao kao popularna biblioteka \u201efabric\u201d, koja ima 201 milijun preuzimanja (7 milijuna preuzimanja u pro\u0161lom mjesecu). Zlonamjerni paket ostao je neprimije\u0107en od 2021. godine i od tada je preuzet vi\u0161e od 37 tisu\u0107a puta. <\/p>\n

Paketa «fabrice» ponavljao je osnovnu funkcionalnost izvorne biblioteke i dodatno uklju\u010divao kod za otkrivanje i slanje na vanjske hostove klju\u010deva za pristup AWS-u (Amazon Web Services), postavljanje bbackdora i izvo\u0111enje odre\u0111enih skripti. Aktivacija zlonamjernih komponenti provodila se u Linuxu i Windowsu. U Linuxu su se datoteke povezane s zlonamjernom aktivno\u0161\u0107u u\u010ditavale u katalog ~\/.local\/bin\/vscode.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0448\u043b\u0430 \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c PGP-\u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439. \u041a\u043b\u044e\u0447\u0435\u0432\u044b\u043c \u043e\u0442\u043b\u0438\u0447\u0438\u0435\u043c \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e, \u0447\u0442\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430 \u0437\u0430\u0432\u0435\u0440\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u043c, \u0430 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043b\u0438\u0446\u043e\u043c (\u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432) \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u043e\u0441\u0442\u0438 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 OpenID Connect (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Katalog PyPI je uveo novi sistem za provjeru autenti\u010dnosti paketa | ProHoster","description":"Razvija\u010di repozitorija Python paketa PyPI (Python Package Index) najavili su implementaciju mehanizma digitalne certifikacije za provjeru autenti\u010dnosti objavljenih paketa, koji je do\u0161ao umesto provere.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0442\u0430\u043b\u043e\u0433 PyPI \u0432\u043d\u0435\u0434\u0440\u0438\u043b \u043d\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u0430\u0442\u0442\u0435\u0441\u0442\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u0448\u043b\u0430 \u043d\u0430 \u0441\u043c\u0435\u043d\u0443 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/katalog-pypi-vnedril-novuyu-sistemu-proverki-podlinnosti-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-11-14T23:09:08+00:00","article:modified_time":"2024-11-14T23:09:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 08:02:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 08:02:22","updated":"2026-01-23 08:02:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/120574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=120574"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/120574\/revisions"}],"predecessor-version":[{"id":164444,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/120574\/revisions\/164444"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/120575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=120574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=120574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=120574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}