{"id":108047,"date":"2023-04-23T12:48:18","date_gmt":"2023-04-23T10:48:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=108047"},"modified":"2023-04-24T10:41:12","modified_gmt":"2023-04-24T08:41:12","slug":"v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","title":{"rendered":"\u00cen PyPI a fost implementat\u0103 posibilitatea public\u0103rii pachetelor f\u0103r\u0103 a fi legate de parole \u0219i token-uri API","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen repozitorul de pachete Python PyPI (Python Package Index) a fost introdus\u0103 o nou\u0103 metod\u0103 securizat\u0103 de publicare a pachetelor, care permite evitarea stoc\u0103rii pe sisteme externe (de exemplu, \u00een GitHub Actions) a parolelor fixe \u0219i a tokenurilor de acces API. Noua metod\u0103 de autentificare se nume\u0219te 'Trusted Publishers' \u0219i are rolul de a rezolva problema public\u0103rii de actualiz\u0103ri mali\u021bioase, rezult\u00e2nd din compromiterea sistemelor externe \u0219i ajungerea parolelor sau tokenurilor predeterminate \u00een m\u00e2inile atacatorilor. <\/p>\n

Noua metod\u0103 de autentificare se bazeaz\u0103 pe utilizarea standardului OpenID Connect (OIDC), care implic\u0103 utilizarea tokenurilor de autentificare cu durat\u0103 limitat\u0103, schimbate \u00eentre serviciile externe \u0219i catalogul PyPI pentru confirmarea opera\u021biei de publicare a pachetului, \u00een locul utiliz\u0103rii tradi\u021bionale a numelui de utilizator\/parolei sau tokenurilor de acces API generate manual. Posibilitatea utiliz\u0103rii mecanismului 'Trusted Publishers' este deja implementat\u0103 pentru handlerii rula\u021bi \u00een GitHub Actions. \u00cen viitor, se a\u0219teapt\u0103 suport pentru Trusted Publishers \u0219i pentru alte servicii externe. <\/p>\n

Pachetele asociate pot, \u00een partea PyPI, s\u0103 aplice un semn de \u00eencredere identificatorilor furniza\u021bi de providerii externi OpenID (IdP, OpenID Connect Identity Provider), pe care serviciul extern \u00eel va folosi pentru a solicita de la PyPI tokenuri de scurt\u0103 durat\u0103. Tokenurile generate OpenID Connect confirm\u0103 leg\u0103tura dintre proiect \u0219i handler, permi\u021b\u00e2nd PyPI s\u0103 efectueze o verificare suplimentar\u0103 a metadatelor, de exemplu, s\u0103 verifice c\u0103 pachetul publicat se coreleaz\u0103 cu un anumit repository. Tokenurile nu sunt stocate, sunt legate de API-uri specifice \u0219i \u00eenceteaz\u0103 s\u0103 mai fie valabile automat dup\u0103 ce expir\u0103 perioada scurt\u0103 de valabilitate. <\/p>\n

\u00cen plus, se poate men\u021biona raportul companiei Sonatype cu informa\u021bii despre identificarea \u00een martie 2023 a 6933 de pachete mali\u021bioase \u00een catalogul PyPI. De la \u00eenceputul anului 2019, num\u0103rul total de pachete mali\u021bioase descoperite \u00een PyPI a dep\u0103\u0219it 115 mii. Majoritatea pachetelor mali\u021bioase se camufleaz\u0103 sub biblioteci populare prin utilizarea tipurilor de denumiri (atributarea unor nume similare, diferite prin c\u00e2teva caractere, de exemplu, exampl \u00een loc de example, djangoo \u00een loc de django, pyhton \u00een loc de python etc.) - atacatorii se bazeaz\u0103 pe utilizatorii neaten\u021bi care fac gre\u0219eli de tipar sau nu observ\u0103 diferen\u021bele \u00een denumire atunci c\u00e2nd caut\u0103. Ac\u021biunile mali\u021bioase se concentreaz\u0103 de obicei pe trimiterea datelor confiden\u021biale g\u0103site pe sistemul local, ca urmare a identific\u0103rii fi\u0219ierelor tipice cu parole, chei de acces, portofele criptografice, tokenuri, cookie-uri de sesiune \u0219i alte informa\u021bii confiden\u021biale.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 GitHub Actions) \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ‘Trusted Publishers’ \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108047","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen PyPI a fost implementat\u0103 posibilitatea public\u0103rii pachetelor f\u0103r\u0103 asocierea la parole \u0219i token-uri API | ProHoster","description":"\u00cen depozitul de pachete Python PyPI (Python Package Index) a fost implementat\u0103 o nou\u0103 metod\u0103 securizat\u0103 de publicare a pachetelor, care permite ocolirea stoc\u0103rii pe sisteme externe (de exemplu, \u00een.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u0430\u0440\u043e\u043b\u044f\u043c \u0438 \u0442\u043e\u043a\u0435\u043d\u0430\u043c API | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-23T10:48:18+00:00","article:modified_time":"2023-04-24T08:41:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=108047"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/108047\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=108047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=108047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=108047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}