{"id":108047,"date":"2023-04-23T12:48:18","date_gmt":"2023-04-23T10:48:18","guid":{"rendered":"https:\/\/prohoster.info\/?p=108047"},"modified":"2023-04-24T10:41:12","modified_gmt":"2023-04-24T08:41:12","slug":"v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","title":{"rendered":"PyPI ka zbatuar mund\u00ebsin\u00eb e publikimit t\u00eb paketave pa u lidhur me fjal\u00ebkalime dhe token\u00eb API","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb depozitorin e paketave Python, PyPI (Python Package Index), \u00ebsht\u00eb ofruar mund\u00ebsia e p\u00ebrdorimit t\u00eb nj\u00eb metode t\u00eb re t\u00eb mbrojtur p\u00ebr publikimin e paketave, q\u00eb lejon shmangien e ruajtjes s\u00eb fjal\u00ebkalimeve dhe token\u00ebve t\u00eb qasjes n\u00eb API n\u00eb sisteme t\u00eb jashtme (p.sh., n\u00eb GitHub Actions). Metoda e re e autentifikimit mori emrin 'Publikues t\u00eb Besuar' dhe ka p\u00ebr q\u00ebllim t\u00eb zgjidh\u00eb problemin e publikimit t\u00eb p\u00ebrdit\u00ebsimeve t\u00eb d\u00ebmshme, t\u00eb cilat realizohen si rezultat i kompromitimit t\u00eb sistemeve t\u00eb jashtme dhe r\u00ebnies n\u00eb duar t\u00eb keqb\u00ebr\u00ebsve t\u00eb fjal\u00ebkalimeve ose token\u00ebve t\u00eb paracaktuar. <\/p>\n

Metoda e re e autentifikimit bazohet n\u00eb p\u00ebrdorimin e standardit OpenID Connect (OIDC), i cili n\u00ebnkupton p\u00ebrdorimin e token\u00ebve t\u00eb autentifikimit me periudh\u00eb t\u00eb kufizuar, t\u00eb cil\u00ebt shk\u00ebmbehen nga sh\u00ebrbimet e jashtme dhe katalogu PyPI p\u00ebr t\u00eb konfirmuar operacionin e publikimit t\u00eb paket\u00ebs n\u00eb vend t\u00eb p\u00ebrdorimit t\u00eb tradicionalit login\/fjal\u00ebkalim ose token\u00ebve t\u00eb qasjes n\u00eb API t\u00eb gjeneruar manualisht. Mund\u00ebsia e p\u00ebrdorimit t\u00eb mekanizmit 'Publikues t\u00eb Besuar' tashm\u00eb \u00ebsht\u00eb realizuar p\u00ebr trajtuesit q\u00eb ekzekutohen n\u00eb GitHub Actions. N\u00eb t\u00eb ardhmen, pritet q\u00eb t\u00eb realizohet mb\u00ebshtetje p\u00ebr Publikues t\u00eb Besuar edhe p\u00ebr sh\u00ebrbime t\u00eb tjera t\u00eb jashtme. <\/p>\n

Mir\u00ebmbajt\u00ebsit e paketave mund t\u00eb vendosin n\u00eb an\u00ebn e PyPI nj\u00eb shenj\u00eb besimi p\u00ebr identifikuesit e ofruar nga ofruesit e jasht\u00ebm OpenID (IdP, OpenID Connect Identity Provider), t\u00eb cil\u00ebt sh\u00ebrbimi i jasht\u00ebm do t\u2019i p\u00ebrdor\u00eb p\u00ebr t\u00eb k\u00ebrkuar nga PyPI token\u00eb me jet\u00eb t\u00eb shkurt\u00ebr. Token\u00ebt e gjeneruar OpenID Connect konfirmojn\u00eb lidhjen midis projektit dhe procesit, gj\u00eb q\u00eb i lejon PyPI t\u00eb kryej\u00eb verifikim shtes\u00eb t\u00eb metadatave, p\u00ebr shembull, t\u00eb kontrolloj\u00eb q\u00eb paketa e publikuar lidhet me nj\u00eb depo t\u00eb caktuar. Token\u00ebt nuk ruhen, jan\u00eb t\u00eb lidhur me API t\u00eb caktuara dhe \u00e7aktivizohen automatikisht pas skadimit t\u00eb periudh\u00ebs s\u00eb tyre t\u00eb shkurt\u00ebr t\u00eb vlefshm\u00ebris\u00eb. <\/p>\n

S\u00eb fundmi, mund t\u00eb theksohet raporti i kompanis\u00eb Sonatype me informacionin mbi identifikimin e 6933 paketave t\u00eb d\u00ebmshme n\u00eb katalogun PyPI gjat\u00eb marsit 2023. Q\u00eb nga viti 2019, numri i paketave t\u00eb d\u00ebmshme t\u00eb identifikuara n\u00eb PyPI ka tejkaluar 115 mij\u00eb. Shumica e paketimeve t\u00eb d\u00ebmshme maskohen pas bibliotekave t\u00eb njohura p\u00ebrmes p\u00ebrdorimit t\u00eb tip-skuotimit (p\u00ebrcaktimi i emrave t\u00eb ngjash\u00ebm, t\u00eb cil\u00ebt diferencohen nga disa simbole, p\u00ebr shembull, exampl n\u00eb vend t\u00eb example, djangoo n\u00eb vend t\u00eb django, pyhton n\u00eb vend t\u00eb python etj.) - keqb\u00ebr\u00ebsit llogarisin te p\u00ebrdoruesit e pap\u00ebrdorur, t\u00eb cil\u00ebt kan\u00eb b\u00ebr\u00eb nj\u00eb gabim n\u00eb shtypje ose nuk e kan\u00eb v\u00ebn\u00eb re diferenc\u00ebn n\u00eb em\u00ebr gjat\u00eb k\u00ebrkimit. Veprimet e d\u00ebmshme zakonisht p\u00ebrfshijn\u00eb d\u00ebrgimin e t\u00eb dh\u00ebnave t\u00eb ndjeshme, q\u00eb gjenden n\u00eb sistemin lokal si rezultat i p\u00ebrcaktimit t\u00eb skedar\u00ebve tipik\u00eb me fjal\u00ebkalime, \u00e7el\u00ebsa qasje, \u00e7anta t\u00eb kriptuara, tokene, cookie sesioni dhe informacion tjet\u00ebr t\u00eb ndjesh\u00ebm.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 GitHub Actions) \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 ‘Trusted Publishers’ \u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0440\u0435\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0441 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-108047","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb PyPI u zbatua mund\u00ebsia e publikimit t\u00eb paketave pa lidhje me fjal\u00ebkalime dhe token API | ProHoster","description":"N\u00eb depozit\u00ebn e paketave Python PyPI (Python Package Index) \u00ebsht\u00eb ofruar mund\u00ebsia p\u00ebr t\u00eb p\u00ebrdorur nj\u00eb metod\u00eb t\u00eb re t\u00eb sigurt p\u00ebr publikimin e paketave, e cila lejon t\u00eb shmanget ruajtja n\u00eb sisteme t\u00eb jashtme (p\u00ebr shembull, n\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0438 \u043a \u043f\u0430\u0440\u043e\u043b\u044f\u043c \u0438 \u0442\u043e\u043a\u0435\u043d\u0430\u043c API | ProHoster","og:description":"\u0412 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI (Python Package Index) \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0431\u043e\u0439\u0442\u0438\u0441\u044c \u0431\u0435\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-pypi-realizovana-vozmozhnost-publikaczii-paketov-bez-privyazki-k-parolyam-i-tokenam-api","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-23T10:48:18+00:00","article:modified_time":"2023-04-24T08:41:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/108047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=108047"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/108047\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=108047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=108047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=108047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}