11–15 of 15 posts
Maintainer's response: https://webcache.googleusercontent.com/search?q=cache:vjUIkP... https://github.com/pypa/warehouse/issues/3896#issuecomment-3...
Two questions: 1) can paramiko.RSAKey handle other encryption schemes (ED25519) ? If not, folks using non-RSA keys wouldn't be affected.. 2) Having a (strong) passphrase for your key file would help prevent the perp from doing any harm with the key(s), or at the very least would give you time to invalidate the key(s). Right?
The solution to the impersonation aspect of this is commit signing. It is literally built into Git. There are no good excuses for project maintainers to not sign commits at this point. Grab a yubikey or other gnupg smartcard and do it. Else someone is going to impersonate you and use your name, reputation, and repos to spread malware like this. Have your git hosting provider refuse unsigned commits (github/gitlab all…
The DEVELOPER is corrupt, the code was not altered on delivery to you.
Maintainer's response: https://webcache.googleusercontent.com/search?q=cache:vjUIkP... https://github.com/pypa/warehouse/issues/3896#issuecomment-3...
It seems there's no way to be 100% certain whether the maintainer ( urigoren ) is a victim or the perpetrator in this case.
The author of the package claims to be a "victim" here, but it's hard to tell. Too bad pip doesn't support package signing.