HelloZeroNet / HelloZeroNet/ZeroNet

please do not depend on python-pip3 - security risk - use dependencies available from distribution package repositories

Offen
#2,326 25 Kommentare 1 Reaktion 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
JavaScript
Sterne
18.8k
Forks
2.3k
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

Instructions on Linux currently require to run `sudo python3 -m pip install -r requirements.txt`. Please consider to drop this if possible.

python pip is a security risk since it does not verify software signatures on packages it downloads. It is also a third party package manager.

Previously a bitcoin wallet was hacked that depended on a third party package manager that didn't verify software signatures.

https://bitpay.com/blog/npm-package-vulnerability-copay/

Could you please use dependencies available from distribution package repositories such as packages.debian.org?

This is also a blocker for ever getting ZeroNet accepted into official packages.debian.org.

This is also a blocker for pre-installation of ZeroNet by default in Whonix.

Related packaging issues:

https://github.com/HelloZeroNet/ZeroNet/issues/382
https://github.com/HelloZeroNet/ZeroNet/issues/241
https://github.com/HelloZeroNet/ZeroNet/issues/1786

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.