[Catalog-sig] getting the public key when --sign is used

martin at v.loewis.de martin at v.loewis.de
Tue Nov 20 00:08:02 CET 2012

Zitat von Daniel Holth <dholth at gmail.com>:

> I can't create two colliding uploads, uploading the first (harmless  
> version) to pypi and then tricking someone into mirroring the second  
> (harmful) version? The system is not designed to protect the  
> uploaded contents at all?

It *is* designed to protect the uploaded contents, but not against the
uploader. Instead, it protects against some mirror operator replacing
a mirrored file, or some attacker taking over a mirror.

If you assume that the package author is malicious, adding SHA hashes
would not help at all. The package author can just upload a new version,
and get it mirrored to all copies (including the master), and nothing
in the mirroring protocol prevents that new version from containing
a trojan horse. All hashes would be intact and fine, and the mirror
be consistent with the master.

> So why not start using sha256?

It's not that simple. Backwards compatibility needs to be considered.
Feel free to write specifications and patches.

And please stop making FUD claims.


More information about the Catalog-SIG mailing list