Differences between revisions 1 and 24 (spanning 23 versions)
Revision 1 as of 2018-02-05 16:05:43
Size: 2659
Comment: first draft of testing landing page
Revision 24 as of 2019-06-17 14:35:25
Size: 5962
Comment: link to user account
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
= Help us test PyPI! =
['''This page is a draft''' and ''not to be used/publicized'' until we close out [[https://github.com/pypa/warehouse/milestone/8|the Maintainer MVP milestone]]. That'll probably be in late February 2018.]
#language en
= Help us test PyPI's 2-Factor Auth! =
Warehouse is the code behind the Python Package Repository ([[https://pypi.org/|PyPI]]). We are seeking maintainers of Projects on PyPI to test our new two-factor auth functionality and send us bug reports. !WebAuthn support is in beta; please help us shake the bugs out!
Line 4: Line 5:
Warehouse is a next-generation Python Package Repository designed to replace the legacy code base that currently powers [[https://pypi.python.org/|PyPI]] ([[https://github.com/pypa/pypi-legacy/|source code on GitHub]], [[https://wiki.python.org/psf/WarehouseRoadmap|roadmap]]). If you maintain a package on PyPI, we'd love for you to test it and send us bug reports. Go to [[https://pypi.org/|the pre-production deployment at https://pypi.org/]] and try it out! Feedback on user experience, accessibility, and overall ease of use are welcome; we want to support your workflows for account management and package maintainership. Go to [[https://pypi.org/manage/account/#two-factor|your account settings]] and try it out!

<<TableOfContents()>>

== Guidelines for Particpation ==
 * By participating, you agree to abide by the [[https://www.pypa.io/en/latest/code-of-conduct/|PyPA Code of Conduct]].
 * We strongly recommend you verify your primary email address on your Test PyPI and PyPI accounts before setting up 2FA.
 * You should sign up for the [[https://mail.python.org/mm3/mailman3/lists/pypi-announce.python.org/|PyPI Announcement Mailing List]] for updates.

== Changes we're making ==

To increase the security of PyPI downloads, we're beginning to introduce two-factor authentication (2FA) as a login security option.

You can use 2FA right now on [[http://test.pypi.org/|Test PyPI]] and on [[https://pypi.org|official PyPI]]. PyPI currently supports a single 2FA method: generating a code through a Time-based One-time Password (TOTP) application. After you set up 2FA on your PyPI account, then you must provide a TOTP (along with your username and password) to log in. Therefore, to use 2FA on PyPI, you'll need to provision an application (usually a mobile phone app) in order to generate authentication codes; see below for suggestions and pointers.

And starting Monday, June 17th, we'll also support !WebAuthn and thus "security keys". A security key (also known as a universal second factor, or U2F key) is hardware device that communicates via USB, NFC, or Bluetooth. Popular keys include Yubikey, Google Titan and Thetis. PyPI supports any [[https://fidoalliance.org/specifications/download/|FIDO U2F compatible key]] and follows the [[https://www.w3.org/TR/webauthn/|!WebAuthn standard]]. Users who have set up this second factor will be prompted to use their key (usually by inserting it into a USB port and pressing a button) when logging in.

The !WebAuthn support is '''in beta''' so check the "caution" warning below.

Two-factor authentication currently only applies to the login step, not package uploads.
Line 7: Line 27:
 * [[https://packaging.python.org/guides/migrating-to-pypi-org/|Upgrade your versions of twine and setuptools]]
 * [[https://packaging.python.org/guides/using-testpypi/|Upload a test package to Test PyPI]]
 * Check whether the project description, release history, download files, project links, maintainers, tags, and classifiers for your project on testpypi.org work correctly ([[https://test.pypi.org/project/1234_hello_world/|example]])
 * [[https://packaging.python.org/tutorials/installing-packages/#installing-from-other-indexes|Use pip to install a package from PyPI.org]]
 * [[https://packaging.python.org/tutorials/distributing-packages/|Upload a new release of your package to PyPI.org]]
Most of these you can test [[https://pypi.org/manage/account/#two-factor|on pypi.org]]. For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use [[https://test.pypi.org/manage/account/#two-factor|test.pypi.org]].
Line 13: Line 29:
== Known issues ==
[[https://github.com/pypa/warehouse/issues|On GitHub.]] Overview:
=== Caution (before you test) ===
Line 16: Line 31:
 * trove classifier issues
 * general user account polish, e.g., [[https://github.com/pypa/warehouse/issues/2887|can't recover account by email]] and [[https://github.com/pypa/warehouse/issues/2065|no confirmation email on new account registration]]
 * until [[https://www.python.org/dev/peps/pep-0541/|PEP 541]] is accepted, we don't have a policy to help us change ownership of package names
 * version sorting issues
 * [[https://github.com/pypa/warehouse/issues/2285|confusing "/legacy" URL]]
 * [[https://github.com/pypa/warehouse/issues/582|deleting legacy documentation]]
 * [[https://github.com/pypa/warehouse/issues/869|no Markdown support]]
 * [[https://github.com/pypa/warehouse/issues/1453|localization]]
During this beta testing period, if things go awry, there's a chance we will need to wipe !WebAuthn tokens from users' accounts, so if you choose to try it, please be forewarned. That's why you need a PyPI-verified email address on [[https://pypi.org/manage/account/|your user account]] before adding a second login auth factor, to make potential account recovery smoother.

Reminder! Sign up for the [[https://mail.python.org/mm3/mailman3/lists/pypi-announce.python.org/|PyPI Announcement Mailing List]] to be kept in the loop as we continue this process!

=== Workflows ===
 * Verify primary email address
 * Add, disable, and remove 2FA token using TOTP
 * Add, disable, and remove 2FA token using U2F (!WebAuthn)
 * Login/Logout
 * Set multiple tokens and login
 * User Registration and Confirmation
 * Password Reset

=== Testers we need ===

In particular, please help us test this if any of these apply to you:

 * use Windows
 * usually visit PyPI on a mobile device
 * are an organization where users share an auth token within a group
 * have 4+ maintainers or owners for one project
 * use an unusual TOTP app or U2F token
 * have a slow Internet connection
 * usually block cookies and !JavaScript (note that you can't set up a U2F key without !JavaScript)
 * maintain 20+ projects
 * created your PyPI account 6+ years ago

=== Setting up a TOTP application ===

See [[https://pypi.org/help/#totp|our help docs]] for guidance on choosing a TOTP app for desktop or mobile.

=== Setting up a U2F security key ===

See [[https://pypi.org/help/#2fa|our help docs]] for guidance on setting up your U2F security key. Please note that you cannot set up or use U2F for a second factor without turning on !JavaScript.

== Security bugs ==
If you find any potential security vulnerabilities, please [[https://pypi.org/security/|follow our published security policy]]. Please don't report security issues in Warehouse via !GitHub, IRC, or mailing lists. Instead, please directly email one or more of our maintainers.

== Our next steps ==

We expect to move on to working on [[https://github.com/pypa/warehouse/issues/994|scoped API keys to make package upload more secure]], then further security, accessibility, and internationalization tasks per [[https://wiki.python.org/psf/WarehouseRoadmap|the Warehouse roadmap]]). Thanks to the Open Technology Fund for funding this work. More progress reports at [[https://wiki.python.org/psf/PackagingWG|the Packaging Working Group's wiki page]].
Line 26: Line 74:
GitHub: https://github.com/pypa/warehouse/issues/new Security issues: [[https://pypi.org/security/|email security @ python dot org]]
Line 28: Line 76:
IRC: [[https://webchat.freenode.net/?channels=%23pypa-dev|#pypa-dev on Freenode]] (someone's usually there 10am-5pm Central Time on weekdays) !GitHub for all other bug reports & feature requests:https://github.com/pypa/warehouse/issues/new
Line 30: Line 78:
Email: [[https://groups.google.com/forum/#!forum/pypa-dev|pypa-dev mailing list]] IRC: [[https://webchat.freenode.net/?channels=#pypa-dev|#pypa-dev on Freenode]] (someone's usually there 10am-5pm Central Time on weekdays)
Line 32: Line 80:
Thank you for testing Warehouse! You're helping us launch sooner and future users of PyPI will appreciate it. :) Email: [[https://mail.python.org/mailman3/lists/distutils-sig.python.org/|distutils-sig mailing list]]

Thank you for testing Warehouse! You're helping us secure this ecosystem, and future users of PyPI will appreciate it. :)

Help us test PyPI's 2-Factor Auth!

Warehouse is the code behind the Python Package Repository (PyPI). We are seeking maintainers of Projects on PyPI to test our new two-factor auth functionality and send us bug reports. WebAuthn support is in beta; please help us shake the bugs out!

Feedback on user experience, accessibility, and overall ease of use are welcome; we want to support your workflows for account management and package maintainership. Go to your account settings and try it out!

Guidelines for Particpation

  • By participating, you agree to abide by the PyPA Code of Conduct.

  • We strongly recommend you verify your primary email address on your Test PyPI and PyPI accounts before setting up 2FA.
  • You should sign up for the PyPI Announcement Mailing List for updates.

Changes we're making

To increase the security of PyPI downloads, we're beginning to introduce two-factor authentication (2FA) as a login security option.

You can use 2FA right now on Test PyPI and on official PyPI. PyPI currently supports a single 2FA method: generating a code through a Time-based One-time Password (TOTP) application. After you set up 2FA on your PyPI account, then you must provide a TOTP (along with your username and password) to log in. Therefore, to use 2FA on PyPI, you'll need to provision an application (usually a mobile phone app) in order to generate authentication codes; see below for suggestions and pointers.

And starting Monday, June 17th, we'll also support WebAuthn and thus "security keys". A security key (also known as a universal second factor, or U2F key) is hardware device that communicates via USB, NFC, or Bluetooth. Popular keys include Yubikey, Google Titan and Thetis. PyPI supports any FIDO U2F compatible key and follows the !WebAuthn standard. Users who have set up this second factor will be prompted to use their key (usually by inserting it into a USB port and pressing a button) when logging in.

The WebAuthn support is in beta so check the "caution" warning below.

Two-factor authentication currently only applies to the login step, not package uploads.

Things to test

Most of these you can test on pypi.org. For testing destructive actions, like removing an owner, deleting a project, or deleting a release, please use test.pypi.org.

Caution (before you test)

During this beta testing period, if things go awry, there's a chance we will need to wipe WebAuthn tokens from users' accounts, so if you choose to try it, please be forewarned. That's why you need a PyPI-verified email address on your user account before adding a second login auth factor, to make potential account recovery smoother.

Reminder! Sign up for the PyPI Announcement Mailing List to be kept in the loop as we continue this process!

Workflows

  • Verify primary email address
  • Add, disable, and remove 2FA token using TOTP
  • Add, disable, and remove 2FA token using U2F (WebAuthn)

  • Login/Logout
  • Set multiple tokens and login
  • User Registration and Confirmation
  • Password Reset

Testers we need

In particular, please help us test this if any of these apply to you:

  • use Windows
  • usually visit PyPI on a mobile device
  • are an organization where users share an auth token within a group
  • have 4+ maintainers or owners for one project
  • use an unusual TOTP app or U2F token
  • have a slow Internet connection
  • usually block cookies and JavaScript (note that you can't set up a U2F key without JavaScript)

  • maintain 20+ projects
  • created your PyPI account 6+ years ago

Setting up a TOTP application

See our help docs for guidance on choosing a TOTP app for desktop or mobile.

Setting up a U2F security key

See our help docs for guidance on setting up your U2F security key. Please note that you cannot set up or use U2F for a second factor without turning on JavaScript.

Security bugs

If you find any potential security vulnerabilities, please follow our published security policy. Please don't report security issues in Warehouse via GitHub, IRC, or mailing lists. Instead, please directly email one or more of our maintainers.

Our next steps

We expect to move on to working on scoped API keys to make package upload more secure, then further security, accessibility, and internationalization tasks per the Warehouse roadmap). Thanks to the Open Technology Fund for funding this work. More progress reports at the Packaging Working Group's wiki page.

Contact us

Security issues: email security @ python dot org

GitHub for all other bug reports & feature requests:https://github.com/pypa/warehouse/issues/new

IRC: #pypa-dev on Freenode (someone's usually there 10am-5pm Central Time on weekdays)

Email: distutils-sig mailing list

Thank you for testing Warehouse! You're helping us secure this ecosystem, and future users of PyPI will appreciate it. :)

WarehousePackageMaintainerTesting (last edited 2019-08-15 21:22:16 by SumanaHarihareswara)

Unable to view page? See the FrontPage for instructions.