🔒️ fix: rename packages to prevent dependency confusion attacks

.github/workflows/release.yml

@@ -18,8 +18,8 @@ jobs:
 
     - name: Validate version sync
       run: |
-        CORE_VERSION=$(python -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('packages/deepfreeze-core/deepfreeze_core/__init__.py').read()).group(1))")
-        CLI_VERSION=$(python -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('packages/deepfreeze-cli/deepfreeze/__init__.py').read()).group(1))")
+        CORE_VERSION=$(python -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('packages/elastic-deepfreeze-core/elastic_deepfreeze_core/__init__.py').read()).group(1))")
+        CLI_VERSION=$(python -c "import re; print(re.search(r'__version__ = \"([^\"]+)\"', open('packages/elastic-deepfreeze-cli/elastic_deepfreeze/__init__.py').read()).group(1))")
         TAG_VERSION=${GITHUB_REF#refs/tags/v}
 
         echo "Core version: $CORE_VERSION"
@@ -28,8 +28,8 @@ jobs:
 
         if [ "$CORE_VERSION" != "$CLI_VERSION" ]; then
           echo "ERROR: Version mismatch between packages!"
-          echo "  deepfreeze-core: $CORE_VERSION"
-          echo "  deepfreeze-cli: $CLI_VERSION"
+          echo "  elastic-deepfreeze-core: $CORE_VERSION"
+          echo "  elastic-deepfreeze-cli: $CLI_VERSION"
           exit 1
         fi
 

.github/workflows/test.yml

@@ -21,17 +21,17 @@ jobs:
     - name: Install dependencies
       run: |
         pip install hatch
-        pip install -e packages/deepfreeze-core[dev]
-        pip install -e packages/deepfreeze-cli[dev]
+        pip install -e packages/elastic-deepfreeze-core[dev]
+        pip install -e packages/elastic-deepfreeze-cli[dev]
 
     - name: Run linting
       run: |
-        cd packages/deepfreeze-core && ruff check deepfreeze_core/
-        cd ../deepfreeze-cli && ruff check deepfreeze/
+        cd packages/elastic-deepfreeze-core && ruff check elastic_deepfreeze_core/
+        cd ../elastic-deepfreeze-cli && ruff check elastic_deepfreeze/
 
     - name: Run tests
       run: |
-        pytest tests/ -v --cov=deepfreeze_core --cov=deepfreeze --cov-report=xml
+        pytest tests/ -v --cov=elastic_deepfreeze_core --cov=elastic_deepfreeze --cov-report=xml
 
     - name: Upload coverage
       uses: codecov/codecov-action@v4

README.md

@@ -10,25 +10,25 @@ See Elastic Search Labs blog post at https://www.elastic.co/search-labs/blog/s3-
 
 This repository contains two packages:
 
-### deepfreeze-core
+### elastic-deepfreeze-core
 
 Core library providing the business logic for deepfreeze operations. Used by both the standalone CLI and Elasticsearch Curator.
 
 ```bash
-pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/deepfreeze-core
+pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/elastic-deepfreeze-core
 ```
 
-[View deepfreeze-core documentation](packages/deepfreeze-core/README.md)
+[View elastic-deepfreeze-core documentation](packages/elastic-deepfreeze-core/README.md)
 
-### deepfreeze-cli
+### elastic-deepfreeze-cli
 
 Standalone CLI tool for managing Elasticsearch S3 Glacier archives.
 
 ```bash
-pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/deepfreeze-cli
+pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/elastic-deepfreeze-cli
 ```
 
-[View deepfreeze-cli documentation](packages/deepfreeze-cli/README.md)
+[View elastic-deepfreeze-cli documentation](packages/elastic-deepfreeze-cli/README.md)
 
 ## Features
 
@@ -44,7 +44,7 @@ pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/
 
 1. Install the CLI:
    ```bash
-   pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/deepfreeze-cli
+   pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/elastic-deepfreeze-cli
    ```
 
 2. Create a configuration file (`config.yml`):
@@ -74,7 +74,11 @@ pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/
 
 ## Integration with Curator
 
-Elasticsearch Curator can use deepfreeze-core as a dependency. See the [Curator documentation](https://github.com/wortmanb/curator) for integration details.
+Elasticsearch Curator can use elastic-deepfreeze-core as a dependency. See the [Curator documentation](https://github.com/wortmanb/curator) for integration details.
+
+## Why "elastic-deepfreeze-*"?
+
+The package names include the `elastic-` prefix to prevent dependency confusion attacks. The original names (`deepfreeze-core`, `deepfreeze-cli`) were vulnerable to name squatting on PyPI. By using a scoped prefix that we control, we ensure that `pip install` will fetch the authentic packages from the Elastic organization.
 
 ## Development
 
@@ -86,8 +90,8 @@ git clone https://github.com/elastic/deepfreeze.git
 cd deepfreeze
 
 # Install both packages in development mode
-pip install -e packages/deepfreeze-core[dev]
-pip install -e packages/deepfreeze-cli[dev]
+pip install -e packages/elastic-deepfreeze-core[dev]
+pip install -e packages/elastic-deepfreeze-cli[dev]
 
 # Run tests
 pytest tests/
@@ -98,14 +102,14 @@ pytest tests/
 ```
 deepfreeze/
 ├── packages/
-│   ├── deepfreeze-core/     # Core library
-│   │   └── deepfreeze_core/
-│   └── deepfreeze-cli/      # Standalone CLI
-│       └── deepfreeze/
+│   ├── elastic-deepfreeze-core/     # Core library
+│   │   └── elastic_deepfreeze_core/
+│   └── elastic-deepfreeze-cli/      # Standalone CLI
+│       └── elastic_deepfreeze/
 ├── tests/
-│   ├── core/                # Core library tests
-│   └── cli/                 # CLI tests
-└── .github/workflows/       # CI/CD
+│   ├── core/                        # Core library tests
+│   └── cli/                         # CLI tests
+└── .github/workflows/               # CI/CD
 ```
 
 ## License

packages/deepfreeze-cli/README.md → packages/elastic-deepfreeze-cli/README.md

@@ -1,4 +1,4 @@
-# Deepfreeze
+# Elastic Deepfreeze CLI
 
 Standalone Elasticsearch S3 Glacier archival and lifecycle management tool.
 
@@ -18,24 +18,16 @@ Deepfreeze provides cost-effective S3 Glacier archival and lifecycle management
 
 ## Installation
 
-### From PyPI (when published)
+### From PyPI
 
 ```bash
-pip install deepfreeze-cli
+pip install elastic-deepfreeze-cli
 ```
 
 ### From Source
 
 ```bash
-# Clone the repository
-git clone https://github.com/wortmanb/curator.git
-cd curator/deepfreeze
-
-# Install in development mode
-pip install -e .
-
-# Or install with development dependencies
-pip install -e ".[dev]"
+pip install git+https://github.com/elastic/deepfreeze.git#subdirectory=packages/elastic-deepfreeze-cli
 ```
 
 ### Verify Installation
@@ -54,8 +46,7 @@ deepfreeze --help
 - Elasticsearch 8.x cluster
 - AWS credentials configured (for S3 access)
 - Required Python packages (installed automatically):
-  - elasticsearch8
-  - boto3
+  - elastic-deepfreeze-core
   - click
   - rich
   - voluptuous
@@ -245,7 +236,7 @@ pip install -e ".[dev]"
 pytest
 
 # Run with coverage
-pytest --cov=deepfreeze --cov-report=term-missing
+pytest --cov=elastic_deepfreeze --cov-report=term-missing
 
 # Run specific test file
 pytest tests/test_actions.py
@@ -257,14 +248,9 @@ pytest tests/test_actions.py
 - No live Elasticsearch or AWS connection required
 - All tests run in isolation
 
-## Independence from Curator
-
-Deepfreeze is a standalone package that operates independently of Elasticsearch Curator. It:
+## Why "elastic-deepfreeze-cli"?
 
-- Has no imports from the curator package
-- Uses its own Elasticsearch client wrapper (not es_client.builder)
-- Maintains its own exception classes
-- Can be installed and run without curator
+The package name includes the `elastic-` prefix to prevent dependency confusion attacks. See the [main README](../../README.md) for details.
 
 ## License
 

packages/deepfreeze-cli/deepfreeze/__init__.py → packages/elastic-deepfreeze-cli/elastic_deepfreeze/__init__.py

@@ -11,7 +11,7 @@
 __version__ = "1.0.1"
 
 # Re-export everything from deepfreeze-core for backward compatibility
-from deepfreeze_core import (
+from elastic_deepfreeze_core import (
     PROVIDERS,
     SETTINGS_ID,
     # Constants

packages/deepfreeze-cli/deepfreeze/cli/__init__.py → packages/elastic-deepfreeze-cli/elastic_deepfreeze/cli/__init__.py

@@ -3,6 +3,6 @@
 This module provides the command-line interface for the standalone deepfreeze package.
 """
 
-from deepfreeze.cli.main import cli
+from elastic_deepfreeze.cli.main import cli
 
 __all__ = ["cli"]

packages/deepfreeze-cli/deepfreeze/cli/main.py → packages/elastic-deepfreeze-cli/elastic_deepfreeze/cli/main.py

@@ -10,10 +10,10 @@
 from pathlib import Path
 
 import click
-from deepfreeze_core import ActionError, DeepfreezeException, create_es_client
+from elastic_deepfreeze_core import ActionError, DeepfreezeException, create_es_client
 
-from deepfreeze import __version__
-from deepfreeze.config import (
+from elastic_deepfreeze import __version__
+from elastic_deepfreeze.config import (
     configure_logging,
     get_elasticsearch_config,
     load_config,
@@ -302,7 +302,7 @@ def setup(
       - The template will be updated to use the specified ILM policy
       - Ensures new indices will automatically use the deepfreeze ILM policy
     """
-    from deepfreeze_core.actions import Setup
+    from elastic_deepfreeze_core.actions import Setup
 
     client = get_client_from_context(ctx)
 
@@ -374,7 +374,7 @@ def rotate(
     """
     Deepfreeze rotation (add a new repo and age oldest off)
     """
-    from deepfreeze_core.actions import Rotate
+    from elastic_deepfreeze_core.actions import Rotate
 
     client = get_client_from_context(ctx)
 
@@ -465,7 +465,7 @@ def status(
     By default, all sections are displayed. Use section flags (-r, -t, -b, -i, -c) to show specific sections only.
     Multiple section flags can be combined.
     """
-    from deepfreeze_core.actions import Status
+    from elastic_deepfreeze_core.actions import Status
 
     client = get_client_from_context(ctx)
 
@@ -516,7 +516,7 @@ def cleanup(
     """
     Clean up expired thawed repositories
     """
-    from deepfreeze_core.actions import Cleanup
+    from elastic_deepfreeze_core.actions import Cleanup
 
     client = get_client_from_context(ctx)
 
@@ -582,7 +582,7 @@ def refreeze(
 
       deepfreeze refreeze
     """
-    from deepfreeze_core.actions import Refreeze
+    from elastic_deepfreeze_core.actions import Refreeze
 
     client = get_client_from_context(ctx)
 
@@ -735,7 +735,7 @@ def thaw(
     """
     from datetime import datetime as dt
 
-    from deepfreeze_core.actions import Thaw
+    from elastic_deepfreeze_core.actions import Thaw
 
     # Validate mutual exclusivity
     # Note: check_status can be None (not provided), "" (flag without value), or a string ID
@@ -833,7 +833,7 @@ def repair_metadata(ctx, porcelain):
 
     Use --dry-run to see what would be changed without making modifications.
     """
-    from deepfreeze_core.actions import RepairMetadata
+    from elastic_deepfreeze_core.actions import RepairMetadata
 
     client = get_client_from_context(ctx)
 

packages/deepfreeze-cli/deepfreeze/config.py → packages/elastic-deepfreeze-cli/elastic_deepfreeze/config.py

@@ -11,7 +11,7 @@
 from typing import Any, Optional
 
 import yaml
-from deepfreeze_core import ActionError
+from elastic_deepfreeze_core import ActionError
 
 # Environment variable prefix for deepfreeze configuration
 ENV_PREFIX = "DEEPFREEZE_"
@@ -267,7 +267,7 @@ def configure_logging(config: dict) -> None:
     logger.propagate = False  # Don't propagate to root logger (prevents duplicates)
 
     # Configure deepfreeze_core logger the same way
-    core_logger = logging.getLogger("deepfreeze_core")
+    core_logger = logging.getLogger("elastic_deepfreeze_core")
     core_logger.setLevel(level)
     core_logger.handlers = handlers
     core_logger.propagate = False

packages/deepfreeze-cli/deepfreeze/validators/__init__.py → packages/elastic-deepfreeze-cli/elastic_deepfreeze/validators/__init__.py

@@ -7,7 +7,7 @@
 
 from voluptuous import Schema
 
-from deepfreeze import defaults
+from elastic_deepfreeze import defaults
 
 # Deepfreeze action option schemas
 # Each schema lists the option defaults that apply to that action

packages/deepfreeze-cli/pyproject.toml → packages/elastic-deepfreeze-cli/pyproject.toml

@@ -3,7 +3,7 @@ requires = ["hatchling"]
 build-backend = "hatchling.build"
 
 [project]
-name = "deepfreeze-cli"
+name = "elastic-deepfreeze-cli"
 version = "1.0.0"
 description = "Standalone Elasticsearch S3 Glacier archival and lifecycle management tool"
 readme = "README.md"
@@ -14,6 +14,7 @@ authors = [
 ]
 keywords = [
     "elasticsearch",
+    "elastic",
     "s3",
     "glacier",
     "archival",
@@ -36,7 +37,7 @@ classifiers = [
     "Topic :: Database",
 ]
 dependencies = [
-    "deepfreeze-core>=1.0.0",
+    "elastic-deepfreeze-core>=1.0.0",
     "click>=8.0.0",
     "voluptuous>=0.14.0",
     "pyyaml>=6.0.0",
@@ -53,19 +54,19 @@ dev = [
 ]
 
 [project.scripts]
-deepfreeze = "deepfreeze.cli.main:cli"
+deepfreeze = "elastic_deepfreeze.cli.main:cli"
 
 [project.urls]
 Homepage = "https://github.com/elastic/deepfreeze"
-Documentation = "https://github.com/elastic/deepfreeze/tree/main/packages/deepfreeze-cli"
+Documentation = "https://github.com/elastic/deepfreeze/tree/main/packages/elastic-deepfreeze-cli"
 Repository = "https://github.com/elastic/deepfreeze"
 
 [tool.hatch.build.targets.wheel]
-packages = ["deepfreeze"]
+packages = ["elastic_deepfreeze"]
 
 [tool.hatch.build.targets.sdist]
 include = [
-    "deepfreeze/**/*.py",
+    "elastic_deepfreeze/**/*.py",
     "README.md",
     "pyproject.toml",
     "config.yml.example",