pytorch - 💡(How to fix) Fix PyTorch CPU wheel index does not expose upload date metadata [3 comments, 3 participants]

TL;DR

Exposing package upload timestamps in the PyTorch CPU wheel index would allow dependency tooling to enforce time-based safety checks.

Guidance

• The lack of upload date metadata in the PyTorch CPU wheel index prevents the application of supply-chain safety policies that exclude recently uploaded packages.
• To mitigate this, the index should be updated to include upload timestamps or equivalent metadata for packages.
• Dependency tooling can then be configured to use this metadata to enforce time-based safety checks, such as excluding packages uploaded within a recent grace window.
• Until this metadata is available, users may need to continue exempting the PyTorch CPU index from these protections, potentially increasing their risk exposure.

Notes

The implementation details of exposing upload timestamps in the PyTorch CPU wheel index are not specified in the issue, and would require further investigation.

Recommendation

Apply workaround: exempt the PyTorch CPU index from time-based safety checks until the index is updated to include upload timestamps, as this allows for some level of protection while awaiting the necessary metadata.