| Title |
Towards a Flexible and Secure Python Package Repository Service |
| Authors |
- I. Sinkarenko, B. Copypresenter, P.J. Elson, F. Iannaccone, W.F. Koorn
CERN, Meyrin, Switzerland
|
| Abstract |
The use of 3rd-party and internal software packages has become a crucial part of modern software development. Not only does it enable faster development, but it also facilitates sharing of common components, which is often necessary for ensuring correctness and robustness of developed software. To enable this workflow, a package repository is needed to store internal packages and provide a proxy to 3rd-party repository services. This is particularly important for systems that operate in constrained networks, as is common for accelerator control systems. Despite its benefits, installing arbitrary software from a 3rd-party package repository can pose security and operational risks. Therefore, it is crucial to implement effective security measures, such as usage logging, package moderation and security scanning. However, experience at CERN has shown off-the-shelf tools for running a flexible repository service for Python packages not to be satisfactory. For instance, the dependency confusion attack first published in 2021 has still not been fully addressed by the main open-source repository services. An in-house development was conducted to address this, using a modular approach to building a Python package repository that enables the creation of a powerful and security-friendly repository service using small components. This paper describes the components that exist, demonstrates their capabilities within CERN and discusses future plans. The solution is not CERN-specific and is likely to be relevant to other institutes facing comparable challenges.
|
| Paper |
download THPDP067.PDF [0.232 MB / 5 pages] |
| Poster |
download THPDP067_POSTER.PDF [0.506 MB] |
| Cite |
download ※ BibTeX
※ LaTeX
※ Text/Word
※ RIS
※ EndNote |
| Conference |
ICALEPCS2023 |
| Series |
International Conference on Accelerator and Large Experimental Physics Control Systems (19th) |
| Location |
Cape Town, South Africa |
| Date |
09-13 October 2023 |
| Publisher |
JACoW Publishing, Geneva, Switzerland |
| Editorial Board |
Volker RW Schaa (GSI, Darmstadt, Germany); Andy Götz (ESRF, Grenoble, France); Johan Venter (SARAO, Cape Town, South Africa); Karen White (SNS, Oak Ridge, TN, USA); Marie Robichon (ESRF, Grenoble, France); Vivienne Rowland (SARAO, Cape Town, South Africa) |
| Online ISBN |
978-3-95450-238-7 |
| Online ISSN |
2226-0358 |
| Received |
05 October 2023 |
| Revised |
12 October 2023 |
| Accepted |
13 December 2023 |
| Issued/td>
| 16 December 2023 |
| DOI |
doi:10.18429/JACoW-ICALEPCS2023-THPDP067 |
| Pages |
1489-1493 |
| Copyright |
 Published by JACoW Publishing under the terms of the Creative Commons Attribution 4.0 International license. Any further distribution of this work must maintain attribution to the author(s), the published article's title, publisher, and DOI. |
|
