python-appimage icon indicating copy to clipboard operation
python-appimage copied to clipboard

setup.py - remove insecure requests to https://pypi.org/pypi/python-appimage/json

Open manfred-kaiser opened this issue 3 years ago • 1 comments

the request to https://pypi.org/pypi/python-appimage/json should be removed, because it breaks workflows, when running without an internet connection.

Another reason is, that you are using _create_unverified_context, which disables certificate validation.

This makes using you package insecure and prone to man in the middle attacks.

Determine the version number this way also breaks reproducible builds.

manfred-kaiser avatar Jun 28 '21 13:06 manfred-kaiser

Is the security aspect of this resolved yet?

hendursaga avatar Apr 17 '24 23:04 hendursaga