Python PyPI 공급망 공격 방어 전략: 타이포스쿼팅부터 다층 보안까지

┌──────────────────────────────────────────────────────────────┐
│                 PyPI 공급망 보안 다층 방어                     │
├──────────┬──────────────┬──────────────┬─────────────────────┤
│ Layer 1  │   Layer 2    │   Layer 3    │    Layer 4          │
│          │              │              │                     │
│ 의존성   │ 취약점       │ 빌드 환경    │ 런타임              │
│ 관리     │ 스캐닝       │ 보안         │ 모니터링            │
│          │              │              │                     │
│ Lockfile │ pip-audit    │ Trusted      │ SBOM                │
│ Pinning  │ safety       │ Publisher    │ 추적                │
│          │              │              │                     │
│ Hash     │ GitHub       │ PEP 740     │ 의존성              │
│ 검증     │ Dependabot   │ Attestation  │ 감사               │
│          │              │              │                     │
│ Private  │ Snyk /       │ 2FA /        │ 이상 탐지           │
│ Index    │ Socket.dev   │ OIDC         │                     │
└──────────┴──────────────┴──────────────┴─────────────────────┘

# pyproject.toml - uv/pip 호환 의존성 관리
[project]
name = "my-secure-app"
requires-python = ">=3.11"
dependencies = [
    "requests==2.31.0",
    "cryptography==42.0.5",
    "pydantic==2.6.1",
]

[tool.uv]
# 프라이빗 인덱스 우선 설정 (의존성 혼동 방어)
index-url = "https://my-company.jfrog.io/pypi/simple/"
extra-index-url = "https://pypi.org/simple/"

[tool.uv.pip]
# 해시 검증 필수화
require-hashes = true

# requirements.txt - 해시 고정 예시
requests==2.31.0 \
    --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7f0edf3fcb0fce8aea3fbd5951d bdf0f4
cryptography==42.0.5 \
    --hash=sha256:6e2b11c55d260d03a8cf29ac9b5e0608c3cb2b6f56af2f20f2132764710 68e5c
pydantic==2.6.1 \
    --hash=sha256:4fd5c182a2488dc63e6d32737ff19937888001e2a6d86e94b3f233104a5 d1fa9

# pip.conf - 프라이빗 인덱스 우선 설정
[global]
index-url = https://my-company.jfrog.io/pypi/simple/
extra-index-url = https://pypi.org/simple/

[install]
# 해시 검증을 기본 활성화
require-hashes = true

# pyproject.toml - uv의 인덱스 전략 설정
[tool.uv]
# "first-match" 전략: 첫 번째 인덱스에서 패키지를 찾으면 다른 인덱스 검색 안 함
index-strategy = "first-match"

[[tool.uv.index]]
name = "internal"
url = "https://my-company.jfrog.io/pypi/simple/"
default = true

[[tool.uv.index]]
name = "pypi"
url = "https://pypi.org/simple/"

# pip-audit 설치 및 실행
pip install pip-audit

# 현재 환경 스캐닝
pip-audit

# requirements.txt 기반 스캐닝
pip-audit -r requirements.txt

# 취약점 자동 수정 (안전한 최신 버전으로 업그레이드)
pip-audit --fix

# JSON 형식 출력 (CI/CD 파이프라인 연동용)
pip-audit -f json -o audit-report.json

# 특정 취약점 무시 (오탐 또는 비적용 사례)
pip-audit --ignore-vuln PYSEC-2024-XXXX

# Safety 설치 및 실행
pip install safety

# 현재 환경 스캐닝
safety check

# requirements.txt 기반 스캐닝
safety check -r requirements.txt

# JSON 출력 형식
safety check --output json

# 전체 프로젝트 디렉토리 스캐닝 (악성 패키지 탐지 포함)
safety scan --target ./my-project/

# .github/workflows/publish.yml - Trusted Publisher 기반 배포
name: Publish to PyPI

on:
  release:
    types: [published]

permissions:
  id-token: write # OIDC 토큰 발급에 필요
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install build dependencies
        run: pip install build

      - name: Build package
        run: python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        # Trusted Publisher 사용 시 password/token 불필요
        # PyPI에서 GitHub 저장소를 Trusted Publisher로 등록해야 함
        with:
          attestations: true # PEP 740 디지털 어테스테이션 자동 생성

  verify:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Verify attestation
        run: |
          pip install pypi-attestations
          python -m pypi_attestations verify my-package

# 어테스테이션 검증 (소비자 측)
pip install pypi-attestations

# 특정 패키지의 어테스테이션 확인
python -c "
import requests
resp = requests.get(
    'https://pypi.org/integrity/requests/2.31.0/'
)
attestations = resp.json()
print(f'Attestation count: {len(attestations)}')
for att in attestations:
    print(f'  Publisher: {att.get(\"publisher\", \"unknown\")}')
"

# .github/workflows/security.yml
name: Python Supply Chain Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # 매일 오전 9시(KST) 정기 스캐닝
    - cron: '0 0 * * *'

permissions:
  contents: read
  security-events: write

jobs:
  dependency-audit:
    name: Dependency Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install pip-audit safety cyclonedx-bom

      - name: Run pip-audit
        run: |
          pip-audit -r requirements.txt \
            -f json \
            -o pip-audit-report.json \
            --desc on
        continue-on-error: false

      - name: Run Safety check
        run: |
          safety check -r requirements.txt \
            --output json \
            > safety-report.json
        continue-on-error: true

      - name: Check for critical vulnerabilities
        run: |
          python3 -c "
          import json, sys
          with open('pip-audit-report.json') as f:
              report = json.load(f)
          vulns = report.get('dependencies', [])
          critical = [v for v in vulns if v.get('vulns')]
          if critical:
              print(f'CRITICAL: {len(critical)} vulnerable packages found')
              for pkg in critical:
                  name = pkg['name']
                  version = pkg['version']
                  for vuln in pkg['vulns']:
                      vid = vuln['id']
                      fix = vuln.get('fix_versions', ['N/A'])
                      print(f'  - {name}=={version}: {vid} (fix: {fix})')
              sys.exit(1)
          print('No vulnerabilities found')
          "

      - name: Upload audit reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            pip-audit-report.json
            safety-report.json

  sbom-generation:
    name: Generate SBOM
    runs-on: ubuntu-latest
    needs: dependency-audit
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install cyclonedx-bom

      - name: Generate CycloneDX SBOM
        run: |
          cyclonedx-py environment \
            --output sbom.json \
            --output-format json \
            --schema-version 1.5

      - name: Validate SBOM
        run: |
          python3 -c "
          import json
          with open('sbom.json') as f:
              sbom = json.load(f)
          components = sbom.get('components', [])
          print(f'SBOM generated: {len(components)} components')
          print(f'Format: CycloneDX {sbom.get(\"specVersion\", \"unknown\")}')
          for comp in components[:5]:
              name = comp.get('name', 'unknown')
              version = comp.get('version', 'unknown')
              print(f'  - {name}@{version}')
          if len(components) > 5:
              print(f'  ... and {len(components) - 5} more')
          "

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

  lockfile-integrity:
    name: Lockfile Integrity Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Verify hash-pinned dependencies
        run: |
          pip install --require-hashes \
            -r requirements.txt \
            --dry-run \
            --no-deps
        continue-on-error: false

      - name: Check for unpinned dependencies
        run: |
          python3 -c "
          import re, sys
          unpinned = []
          with open('requirements.txt') as f:
              for line in f:
                  line = line.strip()
                  if line and not line.startswith('#'):
                      if '==' not in line and '--hash' not in line:
                          unpinned.append(line)
          if unpinned:
              print('WARNING: Unpinned dependencies found:')
              for dep in unpinned:
                  print(f'  - {dep}')
              sys.exit(1)
          print('All dependencies are version-pinned')
          "

# CycloneDX로 Python 프로젝트 SBOM 생성
pip install cyclonedx-bom

# 현재 가상 환경 기반 SBOM 생성
cyclonedx-py environment \
  --output sbom.json \
  --output-format json \
  --schema-version 1.5

# requirements.txt 기반 SBOM 생성
cyclonedx-py requirements \
  --input-file requirements.txt \
  --output sbom-requirements.json \
  --output-format json

# SPDX 형식으로도 생성 가능
pip install spdx-tools

# sbom_validator.py - SBOM 검증 및 분석 스크립트
import json
import sys
from datetime import datetime


def validate_sbom(sbom_path: str) -> dict:
    """SBOM 파일을 검증하고 요약 리포트를 생성합니다."""
    with open(sbom_path) as f:
        sbom = json.load(f)

    components = sbom.get("components", [])
    metadata = sbom.get("metadata", {})

    report = {
        "timestamp": datetime.now().isoformat(),
        "spec_version": sbom.get("specVersion", "unknown"),
        "total_components": len(components),
        "components_without_version": [],
        "components_without_license": [],
        "components_without_purl": [],
    }

    for comp in components:
        name = comp.get("name", "unknown")
        if not comp.get("version"):
            report["components_without_version"].append(name)
        if not comp.get("licenses"):
            report["components_without_license"].append(name)
        if not comp.get("purl"):
            report["components_without_purl"].append(name)

    # 검증 결과 출력
    print(f"SBOM Validation Report")
    print(f"=" * 50)
    print(f"Spec Version: {report['spec_version']}")
    print(f"Total Components: {report['total_components']}")
    print(f"Missing Versions: {len(report['components_without_version'])}")
    print(f"Missing Licenses: {len(report['components_without_license'])}")
    print(f"Missing PURLs: {len(report['components_without_purl'])}")

    # 품질 점수 계산
    total = report["total_components"]
    if total > 0:
        quality_score = (
            1
            - (
                len(report["components_without_version"])
                + len(report["components_without_license"])
                + len(report["components_without_purl"])
            )
            / (total * 3)
        ) * 100
        print(f"Quality Score: {quality_score:.1f}%")
        report["quality_score"] = quality_score

    return report


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python sbom_validator.py sbom.json")
        sys.exit(1)
    validate_sbom(sys.argv[1])

[project]
name = "my-secure-app"
version = "1.0.0"
requires-python = ">=3.11"
dependencies = [
    "requests>=2.31.0,<3.0",
    "cryptography>=42.0.0,<43.0",
    "pydantic>=2.6.0,<3.0",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

# 보안 관련 도구 설정
[tool.pip-audit]
# pip-audit 설정
desc = "on"
progress-spinner = "on"
output = "json"

[tool.safety]
# Safety CLI 설정
output = "json"
continue-on-error = false

[tool.ruff]
# 보안 관련 린트 규칙 활성화
select = [
    "S",     # flake8-bandit (보안 취약점 탐지)
    "B",     # flake8-bugbear
]

[tool.bandit]
# Bandit 정적 보안 분석 설정
exclude_dirs = ["tests", "venv"]
skips = []

# 패키지 설치 전 소스 코드 검사
pip download --no-binary :all: --no-deps suspect-package
# 다운로드된 소스를 압축 해제 후 setup.py 검사

# 또는 pip의 --no-build-isolation 옵션으로 빌드 스크립트 실행을 제한
pip install --no-build-isolation --only-binary :all: package-name

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: 'pip'
    directory: '/'
    schedule:
      interval: 'daily'
    reviewers:
      - 'security-team'
    labels:
      - 'dependencies'
      - 'security'
    open-pull-requests-limit: 10
    # 보안 업데이트만 자동 PR 생성
    allow:
      - dependency-type: 'direct'
    # 메이저 버전 업데이트는 수동 검토
    ignore:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/pypa/pip-audit
    rev: v2.7.3
    hooks:
      - id: pip-audit
        args: ['-r', 'requirements.txt']

  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.8
    hooks:
      - id: bandit
        args: ['-r', 'src/', '-ll']

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']