Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

For example, do they check a digital signature (like apt-get and Windows Update) or can they be required to use SSL? If not, I'm a bit concerned that the downloaded packages could be trojaned..

share|improve this question
1  
Seriously? Your updating tools could be trojaned, the repository could have been hacked or the Python package itself might have a backdoor in it. If you are that concerned about somebody poisoning your downloads, you should install the packages yourself (doing the hash computation on pen and paper just to be sure, of course!). Put simply, I think you are luring yourself into a false sense of security if you think digital signatures are the ultimate answer to viruses. – Thomas Jul 21 '12 at 11:29
@Thomas They can prevent a lot of potential damage when repositories are infected, though. – Thom Wiggers Jul 21 '12 at 12:02
Sure, digital signatures won't protect against a backdoor in the package. They would defend against DNS spoofing and hijacking though. And a way to put backdoors into packages is to hack developer machines, e.g. with a trojaned package ;) – eug Jul 21 '12 at 13:17

2 Answers

up vote 1 down vote accepted

All Python packages are not hosted on pypi.python.org, but easy_install will look the PyPi page for download links. Many common packages like PIL and lxml use their own distribution server (which in fact often causes issues for package consumers). Example: http://pypi.python.org/pypi/PIL/

pypi.python.org itself does not seem to offer HTTPS support of any kind.

If you wish to provide secure easy_install / pip environment I suggest you mirror required packages to a server where you maintain HTTPS yourself and then restrict downloads to this server using --allow-hosts option:

http://packages.python.org/distribute/easy_install.html#restricting-downloads-with-allow-hosts

share|improve this answer
1  
Hmmm.. as I feared the safeguards for python developer security are pretty pitiful. Thanks for that tip - imho it's a step forward for some - but I've just got one laptop, and the challenge is mirroring securely. Currently I'm thinking that the most secure way is to check out the projects VCS repository.. – eug Jul 26 '12 at 8:32
up vote 0 down vote

Where available, MD5 information should be added to download URLs by appending a fragment identifier of the form #md5=..., where ... is the 32-character hex MD5 digest. EasyInstall will verify that the downloaded file’s MD5 digest matches the given value.

http://packages.python.org/distribute/easy_install.html

It seems easy_install does some validation, but it seems it only checks if the package repository supplies the MD5 key.

The future plans section of the same page further hilights this:

Future plans:
- Signature checking? SSL? Ability to suppress PyPI search?

share|improve this answer
but is the MD5 key downloaded from the repository securely? – eug Jul 21 '12 at 13:18
No. It seems it is generated by the repository, and as such only has meaning for the integrity of the download, not for checking malicious code. – Thom Wiggers Jul 21 '12 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.