安全实践#

Token 隐私#

您需要一个私有Token来访问频道和内容。为了您的安全，请将您的Token保存在安全的位置。

Conda 包签名验证#

谨慎

Conda 签名验证需要 conda 版本 4.10.1 或更高版本。默认情况下，签名验证未启用。

conda 签名验证功能（适用于付费访问我们高级存储库的用户）允许您检测在我们的安全构建过程和最终用户的安装过程之间发生的包和包元数据的篡改。它基于更新框架 （TUF），可防御各种攻击。

有关更多信息，请参阅我们关于 conda 签名验证的博客文章。

启用 conda 签名验证#

  1. 安装必要的软件包：

    conda install "conda>=4.10.1" "conda-token>=0.3.0" conda-content-trust

  2. 用conda-token要配置 Access，请打开 Signature Verification 并清空索引缓存：

    conda token set --enable-signature-verification <YOUR_PRODUCT_TOKEN>

现在应该启用 Conda 签名验证。使用 conda 从高级存储库安装包时，conda 通过将以下内容附加到受信任的包来通知您建议的包的签名状态：

(INFO: package metadata is signed by Anaconda and trusted)

如果可信签名与数据不匹配，则可能已发生篡改，conda 将改为向包附加警告：

(WARNING: metadata signature verification failed)

注意

如果当前没有为软件包提供签名（例如，如果从第三方渠道安装），则不会提供签名状态消息。

示例结果
(environment) ➜  ~ conda install django

## Package Plan ##

    environment location: /home/s/miniconda3-av2

    added / updated specs:
        - django


The following packages will be downloaded:

    package                    |            build
    ---------------------------|-----------------
    asgiref-3.3.4              |     pyhd3eb1b0_0          24 KB
    django-3.2                 |     pyhd3eb1b0_0         3.1 MB
    krb5-1.17.1                |       h173b8e3_0         1.3 MB
    libpq-12.2                 |       h20c2e04_0         2.1 MB
    psycopg2-2.8.6             |   py38h3c74f83_1         160 KB
    pytz-2021.1                |     pyhd3eb1b0_0         181 KB
    sqlparse-0.4.1             |             py_0          35 KB
    ------------------------------------------------------------
                                        Total:         6.9 MB

The following NEW packages will be INSTALLED:

    asgiref       repo/main/noarch::asgiref-3.3.4-pyhd3eb1b0_0 (INFO: package metadata is signed by Anaconda and trusted)
    django        repo/main/noarch::django-3.2-pyhd3eb1b0_0 (INFO: package metadata is signed by Anaconda and trusted)
    krb5          repo/main/linux-64::krb5-1.17.1-h173b8e3_0 (INFO: package metadata is signed by Anaconda and trusted)
    libpq         repo/main/linux-64::libpq-12.2-h20c2e04_0 (INFO: package metadata is signed by Anaconda and trusted)
    psycopg2      repo/main/linux-64::psycopg2-2.8.6-py38h3c74f83_1 (INFO: package metadata is signed by Anaconda and trusted)
    pytz          repo/main/noarch::pytz-2021.1-pyhd3eb1b0_0 (INFO: package metadata is signed by Anaconda and trusted)
    sqlparse      repo/main/noarch::sqlparse-0.4.1-py_0 (INFO: package metadata is signed by Anaconda and trusted)

禁用 conda 签名验证#

要关闭该功能，您可以调整 conda 配置：

conda config --set extra_safety_checks false
本页内容