I-PyPI (Python Package Index) Inqolobane yephakheji ye-Python inikeza ikhono lokusebenzisa indlela entsha evikelekile yokushicilela amaphakheji, eqeda isidingo sokugcina amaphasiwedi angaguquki kanye namathokheni okufinyelela e-API ezinhlelweni zangaphandle (isibonelo, ku-GitHub Actions). Indlela entsha yokuqinisekisa ibizwa ngokuthi 'Abashicileli Abathenjwayo' futhi iklanyelwe ukuxazulula inkinga yokushicilela izibuyekezo ezinonya ezenziwa ngenxa yokufaka engozini amasistimu angaphandle nokuwela ezandleni ezingalungile zamaphasiwedi achazwe ngaphambilini noma amathokheni.
Indlela entsha yokuqinisekisa isekelwe ezingeni le-OpenID Connect (OIDC), elibandakanya ukusetshenziswa kwamathokheni okuqinisekisa anesikhathi esinqunyelwe ashintshwayo phakathi kwezinsizakalo zangaphandle kanye nenkomba ye-PyPI ukuze kuqinisekiswe ukusebenza kokushicilela iphakheji, esikhundleni sokusebenzisa ukungena ngemvume okuvamile. /iphasiwedi noma amathokheni okufinyelela e-API akhiqizwayo aqhubekayo. Ikhono lokusebenzisa indlela "Abashicileli Abathenjwayo" selivele lisetshenzisiwe kuzibambi eziqaliswe ku-GitHub Actions. Ukwesekwa Kwabashicileli Abathenjwayo kwezinye izinkonzo zangaphandle nakho kulindeleke esikhathini esizayo.
Abanakekeli bephakheji bangakwazi ohlangothini lwe-PyPI izihlonzi zokwethenjwa ezinikezwa abahlinzeki bangaphandle be-OpenID (i-IdP, i-OpenID Connect Identity Provider), isevisi yangaphandle ezoyisebenzisela ukucela amathokheni angaphili ku-PyPI. Amathokheni akhiqiziwe we-OpenID Connect aqinisekisa ubudlelwano phakathi kwephrojekthi nesibambi, okuvumela i-PyPI ukuthi yenze ukuqinisekiswa okwengeziwe kwemethadatha, njengokuqinisekisa ukuthi iphakheji eshicilelwe ihlotshaniswa nenqolobane ethile. Amathokheni awaphikeleli, aboshelwe kuma-API athile, futhi aphelelwa yisikhathi ngokuzenzakalela ngemva kwempilo emfushane.
Ukwengeza, singaqaphela umbiko wenkampani ye-Sonatype ngolwazi mayelana nokutholwa kwamaphakheji anonya angu-2023 kukhathalogi ye-PyPI ngoMashi 6933. Sekukonke, kusukela ngo-2019, inani lamaphakheji anonya atholwe ku-PyPI lidlule ku-115. Iningi lamaphakheji anonya lifihlwa njengamalabhulali adumile kusetshenziswa i-typequatting (ukunikeza amagama afanayo ahlukile ngezinhlamvu ezithile, isibonelo, i-expl esikhundleni sesibonelo, i-djangoo esikhundleni se-django, i-pyhton esikhundleni se-python, njll.) β abahlaseli bathembele kubasebenzisi abanganakile abenze umshini wokuthayipha noma cha obone umehluko egameni ngesikhathi sokusesha. Izenzo ezinonya ngokuvamile ziholela ekuthumeleni idatha eyimfihlo etholakala kusistimu yendawo ngenxa yokuchaza amafayela avamile anamagama ayimfihlo, okhiye bokufinyelela, izikhwama ze-crypto, amathokheni, amakhukhi weseshini nolunye ulwazi oluyimfihlo.
Source: opennet.ru