brainwane · GitHub

Warehouse is adding an advanced audit trail of user actions beyond the current (existing) journal. This will, for instance, allow publishers to track all actions taken by third party services on their behalf.

  • Add auditing for user actions in PyPI
  • Add auditing for project actions in PyPI
  • Implement a User view for User auditing, allowing publishers to track all actions
    taken by third party services on their behalf
  • Implement a Project view for Project auditing for project maintainers to audit
    actions similarly
  • Implement an Admin view for PyPI.org administrators to audit actions similarly

So:

  • Each user will be able to view a log of sensitive actions performed that are relevant to their user account.
  • Each user who maintains at least one project on PyPI will be able to view a log of sensitive actions
    (performed by ANY user) relevant to projects they act in the Owner Role on.
  • And PyPI administrators will be able to view the full audit log.

We'll be working on this in 2019. The Packaging Working Group, seeking donations and further grants to fund more work, got some new funding from the Open Technology Fund, and the audit log is part of the current grant-funded project.

Read the original on github.com ↗