Secure Software Supply Chains for Python
summary
PyPI hosts nearly 300,000 projects and has removed more than 3,000 malicious libraries after incidents; a dependency confusion variant previously hit Apple Microsoft and 33 other companies. Pip became HTTPS-only four years ago. Practical defenses that work are pip-compile (pip-tools) or pipenv lock producing version pins, full dependency trees and hashes, and pip’s hash checking mode which requires every artifact be hashed. Services like PyUp and Dependabot open pull requests. Integration of PEP 458/TUF and funded malware-detection work for PyPI are in progress.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:14Secure Software Supply Chains for Python PyCon US 2021
- 1:08Software Supply Chain Everything it takes to produce your software
- 2:09Secure Software Supply Chain What is it?
- 2:19Supply Chain Attacks Let's see some examples
- 2:52Supply Chain Attack: Typosquatting
- 3:53Supply Chain Attack: Dependency Confusion
- 5:11Supply Chain Attack: Being a target of "research"
- 5:44Supply Chain Attack: Getting SolarWinded
- 7:30What we can do: HTTPS everywhere
- 8:05What we can do: Use lockfiles
- 10:48Version pins • Hashes X • Full dependency tree
- 11:50An underused workflow Compiled Dependencies
- 14:17What can we prevent with lockfiles?
- 14:46What we can do: Vulnerability notifications
- 16:54Improvemnt: Package Signing
- 18:05Improvement: Fully audited/curated
- 19:21Improvement: The slow but inevitable death of setup.py
- 21:40Improvement: The Update Framework
- 22:34Improvement: Namespaces on PyPI
- 23:44Improvement: More funding for projects
related talks
10mPyPI Supply Chain Security
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
28mWhen pip install Is Not Enough: Real Threats and Practical Defenses
34mSecure Python Development: Tips, Tricks, and Tools
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
29mMaking Python safer than ever
25m"Security considerations in Python Packaging"
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle