Add certificate pinning or a similar alternative to pip https support.

[nejucomo]

Certificate pinning can prevent MITM attacks where the attacker colludes with a certificate authority other than the CA specified by pinning. In the context of pip, such an attack would allow an attacker colluding with a certificate authority to inject code during a pip install.

This is mentioned as a "bonus feature" in #1167, and I decided to make a separate ticket because tickets with more specific scope are more likely to be useful.

[dstufft]

As mentioned in the other thread I'm +1 on this feature.

I believe it needs:

• Exposed in the config so users can manually pin for a particular domain
• Ideally allow domains to pin themselves, there are a couple of options here but probably the most promising is https://tools.ietf.org/html/draft-ietf-websec-key-pinning-01 which is also implemented in Chrome. There is also http://tack.io/ but it requires a TLS extension and thus is harder to implement.

As an aside, users can approximate this feature already using a custom CA bundle but that's far less useful as proper certificate pinning.

[dstufft]

Closing this, in the time since this had been opened I've become -1 on this feature. The place where it would be most useful if PyPI, but PyPI can't pin because we don't control all of our certificates (Fastly controls some of them). In addition this is more or less superseded by the TUF proposal to add package signing, and at that point we only rely on HTTPS for confidentiality.

In addition since we use requests (which uses urllib3) we will get this for "free" if urllib3 implements urllib3/urllib3#607.

[LucidOne]

Perhaps pip could implement something like a backwards version of let's encrypt and update a list of possible pinned certificates from a PGP signed file on PyPI? That way Debian, Fedora, etc only need to ship with the most recent PyPI PGP signing key and pip can securely update as the pinned certificates change instead of when downstream updates their repos.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.