Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by gpm on Tuesday March 02, 2021 @04:28PM
(#26321054)
With Cargo, the final binary (or artifact if you're building a .so/.a/.dylib/...) has a `Cargo.lock` file that pins every recursive and non-recursive dependency. If you audit the packages in that, you've audited every dependency that is used in your project, and they will not change unless you yourself explicitly tell them to.
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by alfiedotwtf on Tuesday March 02, 2021 @08:13PM
(#26323479)
Oh! TIL, thanks!
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by remram on Tuesday March 02, 2021 @04:46PM
(#26321334)
If your direct dependencies pin their dependencies, then you will definitely end with conflicting versions for your transitive dependencies.
This might work in environments like Node, where each library having their own private versions of their dependencies is acceptable, and Rust/Cargo in some situations, but doesn't work in environments where only one version of a package can be present (e.g. Python) or you care about the total size of the dependencies.
Also if you're auditing, wouldn't you audit all dependencies? What does it matter whether they are pinned by your direct dependencies, wouldn't you yourself pin down the transitive dependencies after auditing them?
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by alfiedotwtf on Tuesday March 02, 2021 @08:14PM
(#26323484)
> Also if you're auditing, wouldn't you audit all dependencies?
What’s the point of a transitive dependency can pull the rug out from under your audio with a single update
For example, with `cargo`, let’s say a library I require passes a security audit. However, because a library it requires, or one of its dependencies requires doesn’t pin down a specific version but instead just requires “latest” or “2.1.”, my security audit is for naught given that malware can slip in any time for 2.1..
That goes for testing too. I’ve tested my software etc, but sometime down the line a transitive dependency updates and adds a bug. Now my software that i haven’t changed, is broken.
Software requirements without pinning is a code smell.