File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -228,7 +228,7 @@ the burden on the maintainers to run separate infrastructure and to find
228228and use non-standard features such as local version segments present on
229229an index.
230230
231- **Induced Security Risk: ** This approach has unfortunately led to supply
231+ **Security Risk: ** This approach has unfortunately led to supply
232232chain attacks - more details on the `PyTorch Blog
233233<https://pytorch.org/blog/compromised-nightly-dependency/> `__. It's a
234234non-trivial problem to address which has forced the PyTorch team to
@@ -365,9 +365,9 @@ the version that the software will run against, which requires building
365365without build isolation. On the project side, it requires hosting wheels
366366separately.
367367
368- **Induced Security Risk: ** Similar to regular source builds, this
368+ **Security Risk: ** Similar to regular source builds, this
369369model requires running arbitrary code at install time. The wheels
370- are downloaded entirely outside package manager's control, extending
370+ are downloaded entirely outside the package manager's control, extending
371371the attack surface to two separate wheel download implementations and
372372preventing proper provenance tracking.
373373
You can’t perform that action at this time.
0 commit comments