Security Practices

​

Token privacy

You need a private token to access channels and content. For your security, save your token in a secure location.

​

Conda package signature verification

The conda signature verification feature—available to users with paid access to our premium repository—allows you to detect tampering with packages and package metadata that took place between our secure build process and the end user’s install process. Based on The Update Framework (TUF), it provides defense against a wide variety of attacks.

Please see our blog post on conda signature verification for more information.

​

Enabling conda signature verification

1. Install the necessary packages:

   conda install "conda>=4.10.1" "conda-token>=0.3.0" conda-content-trust
   

2. Use conda-token to configure access, turn on signature verification, and empty the index cache:

   conda token set --enable-signature-verification <YOUR_PRODUCT_TOKEN>
   

Conda signature verification should now be enabled. When using conda to install packages from the premium repository, conda informs you of the signature status of the proposed packages by appending the following to trusted packages:

(INFO: package metadata is signed by Anaconda and trusted)

If the trusted signatures do not match the data, tampering may have occurred, and conda will append a warning to the package instead:

(WARNING: metadata signature verification failed)

​

Disabling conda signature verification

To turn the feature off, you can adjust your conda configuration:

conda config --set extra_safety_checks false