I get this message from systemcheck, what should I do?
WARNING: Kicksecure Unwanted Packages Test Result: 1 unwanted package(s) installed. It is recommended that you remove them from this machine.
- Open a terminal. (Start Menu → System → Terminal)
- Purge.
sudo apt-get purge python3-pip
This is where it’s flagged as unwanted:
Added because PyPI packages are not GPG-signed or signed with any other sufficient signature to prevent malicious tampering:
Recommended action: Follow the instructions printed by systemcheck. I.e., remove python3-pip from your system by running sudo apt-get purge python3-pip. If you need the package for some reason, install and use it in a VM to contain any potential damage.
This thread popped up on my email and I wanted to put my 1.6 pence in on this discussion.
There is two python tools I wanted to install and use only for user (not sysmaint). The rationale is extremely valid of why pip3 is forbidden given the software package supply chain attacks over the past few years. Also what you said that there is no signing of the PyPy packages. Which is big cringe tbh they have checksums but that alone is nothing. I dont know the rationale of why they don’t sign packages.
Is there any foreseeable way to install python packages persistently in a venv for user? I tried something like this but didn’t make it very far haha
If you want to avoid packages from PyPI for security reasons, then the only way I can see for this to happen is if some new Python package manager and repository appears that operates in a secure fashion, and gains enough traction with package developers that it ends up containing the packages you want. Until then, you will likely have to either install things manually from source (which may be very difficult to do initially and even more difficult to keep up-to-date), or live with the insecurities of PyPI.
If the package you want is in Debian’s repos though, and it’s not a security risk for it to be installed system-wide, you could install it from there.
Sadly they are not 
otherwise I would do so
Is python venv security theater?
Python’s venv feature is (by design) not a security feature. It allows you to make separate places where Python packages are installed so that you can avoid dependency conflicts. I.e., if application 1 needs package XYZ version 1.2.3, and application 2 needs package XYZ version 1.2.4, you can have both installed in different venvs even if they usually couldn’t be installed at the same time. The code that runs in each venv is unsandboxed and has whatever permissions the invoking user has. So it’s not security theatre, since it’s not security at all 
That’s not a failing on Python’s part, it’s just not the job venvs are designed for.
It is definitely non-ideal that PyPI doesn’t provide strong code signing given that code installed from PyPI is most likely going to run unsandboxed. That’s more of “security missing” than “security theatre” though.
Ackchyually I found the python3 library in APT!
The one I was looking for was python3-fake-factory
It gets thrown around and implied that venv is sandboxed. Atleast that is my impression.
Really makes you wonder how much software rely on PyPy packages for dependencies.
IYKWIM it might worth including this or at a minimum faker in Whonix and by extension in Kicksecure. It’s like 9 MB’s of space.
Depends on the definition of the word “sandboxed”. Any form of isolation can be considered sandboxing, but some sandboxing is intended for security if used right (user namespaces, virtualization, seccomp) and other sandboxing is intended only for keeping things from accidentally conflicting (chroots, Python venvs, various other kinds of namespacing in Linux, etc.). So a venv is a form of sandboxing, but it doesn’t do anything from a security standpoint. It keeps Python packages from conflicting with each other, but from a security and permissions standpoint, that code runs unsandboxed.
We generally don’t add (or remove) software from the default installation of Kicksecure without a strong technical reason to do so. Some users want more software by default, others want less.
Fair
As a tradeoff per say, since pip3 PyPy is rejected and kicksecure wants to deter its use. It might be worth looking at including python3 libraries like this that are signed from apt given they are small and no security issues and are commonly used. python3-qrcode is included which is nice given you know some python. Wont dwell on it but keep it in consideration.
python3 -c 'import qrcode; qrcode.make("https://www.kicksecure.com/").save("kicksecure_is_based?.png")'
But they can be installed from the apt repositories with sudo apt install by users who know they need them.
Ouch 
