python: PyPi public modules: How to determine if secure and safe?

Question

I am have completed my python 3 application, and it is using multiple public modules from PyPi.

However, before I deploy it to run within my company's enterprise which will be handling credentials of our customers and accessing 3rd party APIs, I need to do due diligence that they are both secure and safe.

What steps must I perform:

1. Validate security of PyPi modules and safe to use, and it is important to note that the target Python 3 app will be handling credentials?
2. What is the most recommended way validate PyPi modules' signature?
3. Can PyPi module signature be trusted?

By the way, the Python 3 application will be running within a Docker container.

Thank you

Answer 1

These are 3 separate questions, so:

1. You'll have to audit the package (or get someone else to do that) to know if it's secure. No easy way around it.

2. All pypi packages have md5 signature attached (link in parentheses after the file). Some of them also attach the pgp signature which shows up in the same place, but it's up to the author whether they're published or not. (https://pypi.python.org/pypi/rpc4django for example includes both md5 and pgp) Md5 verifies integrity. Pgp verifies integrity and origin, so it's a better choice when available.

3. Just as much as any other signature.

If you're worried about dependencies to that level, I think you should look at maintaining your internal pypi repository. It gives you better verification (just sign the packages yourself after initial download and only accept your signature). It gives you better reliability and speed (you can still build the software if pypi goes down). And it avoids issues with replaced / updated packages which you haven't audited/approved yet.