Warehouse needs a register page

[toumorokoshi]

This is a proposal to add a register page to warehouse. The base functionality would mirror what's provided on the current pypi register page:

https://pypi.python.org/pypi?%3Aaction=register_form

[dstufft]

A few thoughts:

• It would be nice to somehow use itsdangerous to implement a registration system that does not require storing a nonce for the email confirmation
• We should take a close look at prior art to see if there is an fiddly bits for security that might be missed.

[toumorokoshi]

Sounds good on looking at PyPi to ensure we cover a similar area of security.

I also like itsdangerous. Effectively we would just have a secret key that we store on the production warehouse box that handles signing and unsigning of keys? The only Issue I could see there is if the key is exposed somehow we have to throw out all current pending validations, but since I assume we'll set like a 1-day expiry it probably doesn't matter anyway.

[dstufft]

Probably more like 3-5 day expiry but yea not a big deal. That would only be used in the case of a compromise anyways.

[JustinCappos]

Is the concern that someone could register without email verification if
the repo is hacked?

If the repo is hacked, I think they can either add entries directly to the
database or slurp mail traffic as it is sent. I might not be
understanding the setup / threat model though...

On Tue, May 20, 2014 at 7:02 PM, Donald Stufft [email protected]:

Probably more like 3-5 day expiry but yea not a big deal. That would only
be used in the case of a compromise anyways.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/322#issuecomment-43694350
.

[dstufft]

It's not a massive big deal, it just means they'd be able to generate verification tokens for emails for us.

[toumorokoshi]

So I've done some investigation of the existing code on Pypi, and here's some things to consider:

gpg_keys

I don't remember where this discussion was, but there was an argument as to whether we should keep gpg keys at all. We only keep a shortened version, and we use it as a mechanism to validate the actual source of a package. I think any package uploaded by the user is automatically associated with this pgp key.

I also feel like it's not a particularly useful mechanism. Please let me know if I'm wrong though.

Pypi as an openid provider

Currently pypi says it has the capabilities to be an OpenID provider. Do we really want this? Managing OpenID is just adding complexity, and I've never thought of using mt pypi account to log into anything.

Logging in with OpenIDs

Right now you can log into pypi with the following OpenID providers:

• google
• launchpad
• myopenid (deprecated as of Feb 2014)

Clearly we have to support these for backward compat reasons. Would we like to support more?

usage agreement

The pypi code mentions a user agreement. I'm not sure what this is about, I don't see one on the register page.

For now I'm going to build a simple page that doesn't support oauth and shoots an e-mail with itsdangerous to validate registration. Just thought I'd throw these out for discussion as I'm working on other pieces.

[dstufft]

1. I don't think we use the gpg at all, we just display it don't we?
2. I think we can probably get rid of this, but I need to check
3. I want to get rid of this too, but I suspect we'll need to discuss it on distutils-sig. PyPI actually supports any OpenID provider as long as it uses protocol 2.0 and is available via HTTPS. Additionally Google is also deprecated.
4. I think this shows up after you confirm your email.

[r1chardj0n3s]

Yep, the gpg key sig is only used for display. It's a not-fully-thought-out feature to accompany the signatures paired with packages.

OpenID is dead, but people are still using it. No idea whether people are using the PyPI OpenID facility though.

[techdragon]

Tiny suggestion, "Sign Up with Github" / "Sign In with Github" would be good. Its becoming quite a common option on programming centric websites using OpenID

[karan]

+1 to "Sign Up with Github".

[demianbrecht]

FWIW, having the ability to register an arbitrary authentication policy would be super helpful for those planning to adopt warehouse behind a corporate firewall and similar environments. In these cases, it might be helpful to be able to strip /all/ auth mechanisms other than some custom method.

[dstufft]

This should actually be completed now.