Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

publish to PyPI? #2

Open
njzjz opened this issue May 13, 2024 · 1 comment
Open

publish to PyPI? #2

njzjz opened this issue May 13, 2024 · 1 comment

Comments

@njzjz
Copy link

njzjz commented May 13, 2024

Hi, I am wondering if you could publish openmpi and mpich to PyPI.

Since PyPI doesn't contain these two packages, it has the risk of being attacked. See:

@dalcinl
Copy link
Member

dalcinl commented May 13, 2024

I could, but there are a few matters to address first.

To begin with, I'm hesitant to take full responsibility of the public PyPI package. One thing is to be the owner of a private repository where you set the all rules under your own responsibility and commitment. A different thing is to deal with public infrastructure as PyPI.

The way my mpich and openmpi packaged are crafted is according to my very particular way of how to do things, and others may not necessarily agree. I'm not a member of either the MPICH or Open MPI development team. Therefore, I don't think it is up to me to set the rules and shove it into everyone's throat.

To the specifics of risk management for the MPICH and Open MPI packages:

  • Theopenmpi https://pypi.org/p/openmpi package is already registered on PyPI, precisely to prevent dependency confusion attacks. Therefore IMHO there are no risks related to Open MPI, unless the owner of the package ([email protected]) is not trustworthy.
  • The mpich package is not registered on PyPI yet. Indeed, it may become an attack vector anytime. If you are a user of the MPICH packages being built here and you care about your own security, then maybe you should contact [email protected] and ask them to also register MPICH, at least for the time being.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants