Projects are deemed ‘critical’ if they are among the top 1% of PyPI projects by numbers of downloads over the prior six months. The Google Open Source Security Team, a sponsor of the Python Software Foundation that maintains PyPI, has provided the keys.Īll maintainers of critical projects will have to log into their accounts using the keys in addition to a password, a requirement that “will go into effect in the coming months”, according to an announcement on the PyPI website. Mindful of the growing threat to software supply chains, the repository is distributing 4,000 Titan Security Keys to qualifying maintainers, who can redeem a promo code for two free keys, either USB-C or USB-A. The Python Package Index (PyPI) is rolling out two-factor authentication (2FA) for “critical projects” in the form of physical security keys. Google is providing Titan Security Keys to maintainers of projects in top 1% of downloads
0 kommentar(er)
