Skip to main content ↑ ↓
Topic: Packaging and Security (Read 453 times) previous topic - next topic
0 Members and 1 Guest are viewing this topic.

Packaging and Security

https://alpha-omega.dev/wp-content/uploads/sites/22/2025/08/Python-White-Paper-for-AO-3.pdf

This is a paper on the core security issues that surround package making and package maintaining.  Specifically, it outlines "phantom" dependencies, which is troubles we have run into more than once, and tries to address those problem.  It is probably worth a read by the Artix packaging crew.  I personally find that it makes forms more questions in my mind than in answers.

Quote
Phantom Dependency” to mean a
software dependency that wasn’t
tracked using packaging metadata,
manifests, or lock files.

That would seem to include nearly any C library outside of a specific known version of libraries.  And specifying library version break so many dependencies and undermines a system that is designed to have version flexibility between minor library upgrades.