-
Notifications
You must be signed in to change notification settings - Fork 1k
Remove internal malware infrastructure/checks #13647
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
cb251c3
to
a40f739
Compare
a40f739
to
c7ac1dc
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nitpick: Looks to be a typo, triggered my malware
searches:
warehouse/warehouse/cli/classifiers.py
Line 23 in 5320917
Manage the Warehouse Malware Checks. |
suggestion: Remove leftovers from tests/common/checks/__init__.py
and associated classes/modules
thoughts: I didn't review the removed modules in depth, since they were removed in their entirety. Same applies for most of the test code. I figured with other protections in place, there's not a high degree of potential breakage. I focused predominantly on the integration parts of this code and the rest of the stack.
Other than a few smaller items included inline and above, this should be a relatively simple re-review once addressed.
warehouse/migrations/versions/a81f6cb8fc31_remove_malware_infrastructure.py
Outdated
Show resolved
Hide resolved
Signed-off-by: Mike Fiedler <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added a commit removing test config I had missed earlier.
Gonna wait for a 👍🏼 from @di. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's clear that supporting 3rd party reports from trusted reporters is a better path towards actually removing malware here.
.. _celery crontab: https://docs.celeryq.dev/en/latest/reference/celery.schedules.html#celery.schedules.crontab | ||
.. _prepare classmethod: https://github.com/pypi/warehouse/blob/main/warehouse/malware/checks/base.py | ||
.. _MalwareVerdict model: https://github.com/pypi/warehouse/blob/main/warehouse/malware/models.py | ||
.. |CheckLifecycle| image:: ../_static/check-lifecycle.png |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the two images referenced here were not removed by the PR
This languished.
There was some discussion of re-using this infrastructure for other use cases such as scanning uploads for secrets to report them to providers (similar to GitHub token scanning).
I propose #13596 combined with some form of "what's new!" feed to build out a more generic interface for internal and external "third parties" to perform these kinds of scans and report them to PyPI.
Closes #12412.