Proposal: Security considerations in Python Packaging

IndiaFOSS Conference CFP IndiaFOSS 2.0
1

Proposal: Security considerations in Python Packaging

Popular programming language index websites (TIOBE index) and developer surveys (Stack Overflow) place Python as one of the fastest-growing programming languages. However, this popularity also puts in the target range of attackers. The attackers perform malicious dependency attacks and use misconfiguration tools to reveal confidential information. Jukka Ruohonen, Kalle Hjerppe, and Kalle Rindell in their research paper “A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI” claimed that they scanned PyPI for security issues in Python packages and found the presence of at least one security issue in about 46% of the Python packages. In addition, security vulnerabilities can be present in the source code of the package. In this talk, we will address the security issues related to python packaging and possible solutions to make python packages secure. The talk begins with the importance of a secure package and vulnerabilities in the Python package index. Then, I will discuss Python packages such as Bandit for identifying common security issues in Python code and “safety” for dependency check. Next, I will discuss verifying and signing Python packages using GPG and semgrep static analyser. Finally, I will discuss general guidelines for secure coding practices in Python.

Outline

  1. Importance of a secure package and vulnerabilities in python package index. (02 Minutes)
  2. Bandit for identifying common security issues in Python code (04 Minutes)
  3. safety for dependency check (04 Minutes)
  4. Verifying and signing PyPI and conda packages using GPG and Twine(02 Minutes)
  5. semgrep static analyser (04 Minutes)
  6. General guidelines for secure coding practices in Python (02 Minutes)
  7. Summary and Questions (02 Minute )

Expected Duration of my talk: 20 min
Reference/Source-code (URL): https://docs.python.org/3/library/security_warnings.html
Proposed by: Gajendra Deshpande

2

A little but about secure publishing workflow will be nice:

  • Setting up 2FA on PyPI (Including Security Keys)
  • Using a scoped API Token instead of password for Publishing packages
  • (Assuming this ships before IndiaFOSS) Using GitHub Actions OIDC based publication flow for PyPi that provides “tokenless-publishing” based on Identity authentication.

Further, I’d love to hear more about special considerations for Binary packages that bundle their dependencies (point 3 in your list should cover this ideally) - ensuring binary dependencies (.so files) are not vulnerable. Look at the issues here for example.