Which software artifact should we trust?
Software package registries are open to the public, they essentially allow anyone really to share there libraries and code. I was curious about how to these packages could be vetted, inspected and triaged before ingesting/consuming.
Many times we just type…
-> pip install <our fav package>
OR
-> uv install <our other fav package>
Enter fullscreen mode Exit fullscreen mode
This works most times and allows us to use our favorite packages from PyPI. There is a danger to be weary of, that of typosquatting, developer account take over and ultimately the publisher of the package not following OSS or PyPI best practices.
Even the most used python packages could be a risk, so to address this pre-ingestion issue, I created a tool that allows for me to triage and inspect package metadata and provenance evidence before downloading the package.
What I Learned:
PyPI is a great source for evidence of attestation.
Author or Maintainer Information can usually readily be found.
License of the package is also listed, helpful before building with varied license restrictions/liberties.
SHA is explicitly listed and verifiable with packages you plan to build with. Allowing the practice of SHA pinning to persist.
Open Source Security starts way left, at the package registry layer. All compromised cannot be caught here, but this practice can enhance OSS significantly. Inspecting packages at source.
I look forward to iterating on this tool more and more in the very near future to enhance supply chain security and my own efforts to contribute to open source security initiatives.
What tools do you like to use to inspect and vet open sources packages at the registry level?
Link to Baro Tool
https://github.com/ceaz-sec/baro
Example Triage Reports:
https://github.com/ceaz-sec/baro/tree/main/src/reports