HTTPX designated as critical on PyPI

[florimondmanca]

Hi @encode/maintainers,

Ive just received an email today from PyPI indicating HTTPX has been designated as a “critical project”.

The impact seems to be: 2FA must be enabled to “add new releases or manage the project”.

Tweet: https://twitter.com/pypi/status/1545455297388584960

I’m raising this discussion to discuss potential changes this induces for us.

As I understand we create releases through a PyPI token. Does this mean the account attached to the token has to enable 2FA so we can create further releases?

On my end, I can see I cannot access the “Manage” section (button disabled) for httpx on PyPI anymore, presumably until I enable 2FA.

[euri10]

I thought being part of encode required 2fa, I dont think I had it before

[br3ndonland]

Thanks @florimondmanca for bringing this up for discussion.

I thought being part of encode required 2fa, I dont think I had it before

I think encode requires 2fa on GitHub, but not necessarily on PyPI.

I'm not sure who controls the PyPI token, but it would be a good idea for that account to have 2fa set up.

Does anyone know who owns the PyPI token?

How is the token scoped (all projects for the account, or only one project per token)?

Is it rotated with any regularity?

[Kludex]

Does anyone know who owns the PyPI token?

Probably Tom.

How is the token scoped (all projects for the account, or only one project per token)?

Should be per project.

Is it rotated with any regularity?

afaik, no.

@tomchristie should be able to confirm what I said.

[tomchristie]

Probably Tom.

Correct.

Should be per project.

Correct.

Is it rotated with any regularity?

Nope. Security-wise I don't believe we have any pressing need for rotation, given how it is used. I don't know the token value, nd I'm no longer able to access it.

The only places where it is stored are within GitHub's infra as a completely hidden environment variable...

...and within PyPI, which also doesn't allow me to view it...

I'm not sure who controls the PyPI token, but it would be a good idea for that account to have 2fa set up.

Agreed. I will take a look at that.

Perhaps we could get someone(s) else on the team to also have 2fa & a key?

Ideally I'd suggest we have 3 team members with privileges over our PyPI projects, and admin rights to the org.

(Encode OSS can finance the purchase of the keys, and we should also look at how we deal with our finances, invoices, salaries, proposals. But that's a different story.)

[br3ndonland]

Sounds like a good plan. I use a YubiKey 5C NFC for PyPI and GitHub, and have been very happy with it.

[jhominal]

I have never released anything on PyPI so I have no idea how that is structured.

I guess that either there is a single account that has publishing rights on PyPI, and to which encode/operations have access, or each member of encode/operations has their own account, that has publishing rights on PyPI?

[Kludex]

I'm not an owner of any encode project, and I'm part of encode/operations. The encode/operations is only used to deploy a release through the GitHub actions.

[Kludex]

As I understand we create releases through a PyPI token. Does this mean the account attached to the token has to enable 2FA so we can create further releases?

I guess that's the case. cc @tomchristie