安全实践#

令牌隐私#

您需要私有令牌才能访问频道和内容。为了您的安全，请将您的令牌保存在安全的位置。

Conda 包签名验证#

注意

Conda 签名验证需要 conda 版本 4.10.1 或更高版本。默认情况下未启用签名验证。

conda 签名验证功能（付费访问我们高级仓库的用户可用）允许您检测在我们安全构建过程和最终用户的安装过程之间发生的对包和包元数据的篡改。基于 The Update Framework (TUF)，它提供了针对各种攻击的防御。

有关更多信息，请参阅我们关于 conda 签名验证的博客文章。

启用 conda 签名验证#

  1. 安装必要的包

    conda install "conda>=4.10.1" "conda-token>=0.3.0" conda-content-trust

  2. 使用 conda-token 配置访问权限，开启签名验证，并清空索引缓存

    conda token set --enable-signature-verification <YOUR_PRODUCT_TOKEN>

Conda 签名验证现在应该已启用。当使用 conda 从高级仓库安装包时，conda 会通过在受信任的包后附加以下内容来告知您建议包的签名状态

(INFO: package metadata is signed by Anaconda and trusted)

如果受信任的签名与数据不匹配，则可能发生了篡改，conda 将在包后附加警告

(WARNING: metadata signature verification failed)

注意

如果当前未为包提供签名（例如，如果您从第三方频道安装），则不提供签名状态消息。

示例结果
(environment) ➜  ~ conda install django

## Package Plan ##

    environment location: /home/s/miniconda3-av2

    added / updated specs:
        - django


The following packages will be downloaded:

    package                    |            build
    ---------------------------|-----------------
    asgiref-3.3.4              |     pyhd3eb1b0_0          24 KB
    django-3.2                 |     pyhd3eb1b0_0         3.1 MB
    krb5-1.17.1                |       h173b8e3_0         1.3 MB
    libpq-12.2                 |       h20c2e04_0         2.1 MB
    psycopg2-2.8.6             |   py38h3c74f83_1         160 KB
    pytz-2021.1                |     pyhd3eb1b0_0         181 KB
    sqlparse-0.4.1             |             py_0          35 KB
    ------------------------------------------------------------
                                        Total:         6.9 MB

The following NEW packages will be INSTALLED:

    asgiref       repo/main/noarch::asgiref-3.3.4-pyhd3eb1b0_0 (INFO: package metadata is signed by Anaconda and trusted)
    django        repo/main/noarch::django-3.2-pyhd3eb1b0_0 (INFO: package metadata is signed by Anaconda and trusted)
    krb5          repo/main/linux-64::krb5-1.17.1-h173b8e3_0 (INFO: package metadata is signed by Anaconda and trusted)
    libpq         repo/main/linux-64::libpq-12.2-h20c2e04_0 (INFO: package metadata is signed by Anaconda and trusted)
    psycopg2      repo/main/linux-64::psycopg2-2.8.6-py38h3c74f83_1 (INFO: package metadata is signed by Anaconda and trusted)
    pytz          repo/main/noarch::pytz-2021.1-pyhd3eb1b0_0 (INFO: package metadata is signed by Anaconda and trusted)
    sqlparse      repo/main/noarch::sqlparse-0.4.1-py_0 (INFO: package metadata is signed by Anaconda and trusted)

禁用 conda 签名验证#

要关闭此功能，您可以调整您的 conda 配置

conda config --set extra_safety_checks false
在本页中