4

For example, do they check a digital signature (like apt-get and Windows Update) or can they be required to use SSL? If not, I'm a bit concerned that the downloaded packages could be trojaned..

Improve this question
3
  • 1
    Seriously? Your updating tools could be trojaned, the repository could have been hacked or the Python package itself might have a backdoor in it. If you are that concerned about somebody poisoning your downloads, you should install the packages yourself (doing the hash computation on pen and paper just to be sure, of course!). Put simply, I think you are luring yourself into a false sense of security if you think digital signatures are the ultimate answer to viruses.
    – Thomas
    Jul 21, 2012 at 11:29
  • 1
    @Thomas They can prevent a lot of potential damage when repositories are infected, though.
    – Thom Wiggers
    Jul 21, 2012 at 12:02
  • Sure, digital signatures won't protect against a backdoor in the package. They would defend against DNS spoofing and hijacking though. And a way to put backdoors into packages is to hack developer machines, e.g. with a trojaned package ;)
    – eug
    Jul 21, 2012 at 13:17

3 Answers 3

Reset to default
3

Pip has been updated:

SSL Certificate Verification

Starting with v1.3, pip provides SSL certificate verification over https, to prevent man-in-the-middle attacks against PyPI downloads.

Version 8.0 also has the functionality to check against local hashes.

Improve this answer
2

All Python packages are not hosted on pypi.python.org, but easy_install will look the PyPi page for download links. Many common packages like PIL and lxml use their own distribution server (which in fact often causes issues for package consumers). Example: http://pypi.python.org/pypi/PIL/

pypi.python.org itself does not seem to offer HTTPS support of any kind.

If you wish to provide secure easy_install / pip environment I suggest you mirror required packages to a server where you maintain HTTPS yourself and then restrict downloads to this server using --allow-hosts option:

http://packages.python.org/distribute/easy_install.html#restricting-downloads-with-allow-hosts

Improve this answer
2
  • 1
    Hmmm.. as I feared the safeguards for python developer security are pretty pitiful. Thanks for that tip - imho it's a step forward for some - but I've just got one laptop, and the challenge is mirroring securely. Currently I'm thinking that the most secure way is to check out the projects VCS repository..
    – eug
    Jul 26, 2012 at 8:32
  • 1
    Please see the answer below, this answer is outdated.
    – Mikko Ohtamaa
    Mar 31, 2016 at 14:44
1

Where available, MD5 information should be added to download URLs by appending a fragment identifier of the form #md5=..., where ... is the 32-character hex MD5 digest. EasyInstall will verify that the downloaded file’s MD5 digest matches the given value.

http://packages.python.org/distribute/easy_install.html

It seems easy_install does some validation, but it seems it only checks if the package repository supplies the MD5 key.

The future plans section of the same page further hilights this:

Future plans:
- Signature checking? SSL? Ability to suppress PyPI search?

Improve this answer
2
  • but is the MD5 key downloaded from the repository securely?
    – eug
    Jul 21, 2012 at 13:18
  • 1
    No. It seems it is generated by the repository, and as such only has meaning for the integrity of the download, not for checking malicious code.
    – Thom Wiggers
    Jul 21, 2012 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .