Keeping a Look-Alike Package Out of a Build is a practical DevSecOps project about deciding which dependency bytes belong in a useful build. You will repair a prepared ticket-pricing tool, then apply the same methods to a workshop material desk.
Two Guided Labs introduce package-source selection and complete dependency hashes. The independent Challenge changes the package relationships while keeping the same tools and installation contract.
What You Will Learn
- Identify direct and indirect dependencies and explain why a second pip index is not a lower-priority backup.
- Rebuild approved packages in separate Python environments and deliver a complete, correct price list.
- Reject same-name, same-version wheel replacements using independently approved hashes.
- Preserve legitimate mirrors, quoted paths, application behavior and original order data.
Who This Course Is For
This course is for beginning DevSecOps learners who can use cd, cat and basic terminal commands and edit a small text file. No Python programming, Docker or cloud account is required. The first Guided Lab explains the virtual environments, pip options and small Shell recipe used throughout.
Learning environment: Each lab starts independently with Python, pip, original synthetic wheels and local package sources prepared in your browser-based Linux terminal.
Frequently Asked Questions
Do I need to publish or attack a public package?
No. Every source and package is controlled inside the training environment. The substitute packages only change example calculations.
Does a matching hash prove a package is safe?
It proves that the bytes match the independently supplied approval. It does not identify the publisher or establish absence of vulnerabilities.
What is the practical deliverable?
A reusable installation recipe, the actual approved environment and a correct CSV handover. The Challenge must also reject changed direct and indirect dependencies while allowing unchanged mirrors.
