index-url extra-index-url install priority order
This is totally related to #5045, but I can not comment on it. For me this should be re-opened, because it's a security issue. I provide the package `xxx` to the private repository `my-company.com`. Then I gives installation instructions to collaborators, configure CI to install this package, etc. The problem is if someone add a package with the same name on pypi.org, then users and CI will get this package instead of mine, which is bad: and I want to be sure that the installation will not change. It's not about naming package: if I name my packe `my_company.xxx`, a malicious user could chose the exact same name and publish it to pypi, letting my collaborators installing a malware instead of my package.
Posted by lypwig on Jul 21, 2020, 7:31 AM
Tags
Related issues
- Some other ones to add on from my fresh install: Start menu search will search the Microsoft Store for apps they want you to install, som...
- New Release?
- 【Not An Issue But Tutorial】A complete tutorial of pre-processing steps
- Meta issue: plugin system
- Accept `Json` field paths when trying to order by `Json` field
- proposal: cmd/go: allow versioned `go build` commands
Raise real-world problems, find people facing the same issue, and discuss solutions.3,500 issues0 comments
onboarding (E-commerce)
Some other ones to add on from my fresh install: Start menu search will search the Microsoft Store for apps they want you to install, som...
New Release?
【Not An Issue But Tutorial】A complete tutorial of pre-processing steps
Meta issue: plugin system
Accept `Json` field paths when trying to order by `Json` field
proposal: cmd/go: allow versioned `go build` commands
[Proposal] New tutorial for "How to install PCL for windows x64 Visual Studio 2019"
index-url extra-index-url install priority order
index-url extra-index-url install priority order
This is totally related to #5045, but I can not comment on it. For me this should be re-opened, because it's a security issue. I provide the package `xxx` to the private repository `my-company.com`. Then I gives installation instructions to collaborators, configure CI to install this package, etc. The problem is if someone add a package with the same name on pypi.org, then users and CI will get this package instead of mine, which is bad: and I want to be sure that the installation will not change. It's not about naming package: if I name my packe `my_company.xxx`, a malicious user could chose the exact same name and publish it to pypi, letting my collaborators installing a malware instead of my package.
Comments (0)
No comments yet. Start the discussion.