Path: csiph.com!tncsrv06.tnetconsulting.net!newsfeed.endofthelinebbs.com!news.corradoroberto.it!gothmog.csi.it!bofh.it!news.nic.it!robomod From: Simon Josefsson Newsgroups: linux.debian.maint.python Subject: Re: Bug#1090897: ITP: python-sigstore-protobuf-specs -- Python bindings for Sigstore's protocol buffer (protobuf) specs Date: Sat, 21 Dec 2024 00:40:02 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Fri Dec 20 23:36:04 2024 Old-Return-Path: X-Amavis-Spam-Status: No, score=-14.5 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate:hard: -4.6 X-Hashcash: 1:23:241220:debian-python@lists.debian.org::qPu4araqoLQR/WEo:qCF Openpgp: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE; url=https://josefsson.org/key-20190320.txt X-Hashcash: 1:23:241220:1090897@bugs.debian.org::QrTZ0BUjdwdac5x+:2ZCd X-Hashcash: 1:23:241220:submit@bugs.debian.org::4ibsBpOpCpbum8OY:YqDY User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" X-Mailing-List: archive/latest/22695 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/87y10adj1k.fsf@kaka.sjd.se Approved: robomod@news.nic.it Lines: 62 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 21 Dec 2024 00:35:51 +0100 X-Original-Message-ID: <87y10adj1k.fsf@kaka.sjd.se> X-Original-References: <87wmfufeei.fsf__43421.9961798348$1734716192$gmane$org@kaka.sjd.se> Xref: csiph.com linux.debian.maint.python:16603 --=-=-= Content-Type: text/plain Hi, I would appreciate packaging review of: https://salsa.debian.org/python-team/packages/python-sigstore-protobuf-specs Some questions/concerns: - Same concern about using PyPI tarballs as for the other packages, some files are missing compared to upstream's GitHub repository. Maybe this is actually common for Python packages, and understanding this is part of my learning curve. But it still feels surprising to me, and a bit sub-optimal from a supply-chain safety point of view: which hosting site to rely on? PyPI that publish tarballs, or GitHub who (should) hold the source code used to generate the tarballs? How to detect when these differ? What to do about it? /Simon Simon Josefsson writes: > Package: wnpp > Severity: wishlist > Owner: Simon Josefsson > X-Debbugs-Cc: debian-devel@lists.debian.org, debian-python@lists.debian.org > > * Package name : python-sigstore-protobuf-specs > Version : 0.3.3 > Upstream Author : The Sigstore Authors > * URL : https://github.com/sigstore/protobuf-specs > * License : Apache-2 > Programming Lang: Python > Description : Python bindings for Sigstore's protocol buffer (protobuf) specs > > These are the Python language bindings for Sigstore's protobuf specs. > > I plan to maintain this package as part of the Python team: > > https://salsa.debian.org/python-team/packages/python-sigstore-protobuf-specs > > Work in progress will hopefully be found here: > > https://salsa.debian.org/jas/sigstore-protobuf-specs > https://salsa.debian.org/jas/protobuf-specs > > /Simon > --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iIoEARYIADIWIQSjzJyHC50xCrrUzy9RcisI/kdFogUCZ2X/VxQcc2ltb25Aam9z ZWZzc29uLm9yZwAKCRBRcisI/kdFolTAAQDU5YMZXvSIkMSIiKimvmc2mFX2V7/3 200kBkhEqQ9/RgD/aAcwdR0iEHP71vHRD+g96DsdxzCoI4ieYKjxXP8MUwg= =Tcrn -----END PGP SIGNATURE----- --=-=-=--