And while I do think code signing alone would’ve helped in the recent issues, what I’d like to see is a sort of automated package scanner that searches for this kind of malware and then publishes a signed report enumerating the things verified alongisde package pypi metadata.
Then I could verify both the package and the scanners result and decide to update or not.
i know this is day dreaming cause who would sponsor scanning and attesting every open source project, anthropic?
i like the efforts behind sigstore.dev project.
And while I do think code signing alone would’ve helped in the recent issues, what I’d like to see is a sort of automated package scanner that searches for this kind of malware and then publishes a signed report enumerating the things verified alongisde package pypi metadata.
Then I could verify both the package and the scanners result and decide to update or not.
i know this is day dreaming cause who would sponsor scanning and attesting every open source project, anthropic?