Groups > linux.debian.maint.python > #16316

Re: python devs are planning to stop signing with gpg

Path	csiph.com!news.mixmin.net!news2.arglkargh.de!news.karotte.org!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Louis-Philippe Véronneau <pollo@debian.org>
Newsgroups	linux.debian.maint.python
Subject	Re: python devs are planning to stop signing with gpg
Date	Thu, 03 Oct 2024 20:30:01 +0200
Message-ID	<JtyKl-gHL8-7@gated-at.bofh.it> (permalink)
References	<Jswrf-g28h-7@gated-at.bofh.it> <JswUh-g2I4-11@gated-at.bofh.it> <JswUh-g2I4-9@gated-at.bofh.it> <JtvW9-gG49-3@gated-at.bofh.it>
X-Mailbox-Line	From debian-python-request@lists.debian.org Thu Oct 3 18:22:28 2024
Old-Return-Path	<pollo@debian.org>
X-Amavis-Spam-Status	No, score=-108.01 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, BODY_8BITS=1.5, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_MED=-2.3, UNPARSEABLE_RELAY=0.001, USER_IN_DKIM_WELCOMELIST=-0.01, USER_IN_DKIM_WHITELIST=-100] autolearn=ham autolearn_force=no
MIME-Version	1.0
User-Agent	Mozilla Thunderbird
Content-Language	en-US
Autocrypt	addr=pollo@debian.org; keydata= xjMEYEPdjBYJKwYBBAHaRw8BAQdA5yh8SOHhcvKeX/A4rv0/JTCL8Kgnnwy4/okKh1Htbs3N LExvdWlzLVBoaWxpcHBlIFbDqXJvbm5lYXUgPHBvbGxvQGRlYmlhbi5vcmc+wpYEExYKAD4C GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQT2TWHTIfPLSJFWdT3h5UV8i61BEwUCZb/f iAUJDuIDfAAKCRDh5UV8i61BEzdaAP0cGJp8CpkywzefhdaJjfK5/uAQLRg5Bk6yCWnyR8B4 wQEAxA4C39PJPsosgOVBMdfkzCPhGVynYBnujOyEcksX1w/OOARgQ+DlEgorBgEEAZdVAQUB AQdAgRLbDfS/6GLXd15qI9zHso9UwJQgDbme7pvL1Z9rkG4DAQgHwn4EGBYKACYCGwwWIQT2 TWHTIfPLSJFWdT3h5UV8i61BEwUCZb/fsAUJDuIASgAKCRDh5UV8i61BEwYaAQDhvbQQqmTD F/fdodzfiY45IWYckb9rCvKaVnfP6DOY9QEA/eeaEWmOq2NpOYpBesVjBZCLe8jKv1WPMfLL YOfDIAc=
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	8bit
X-Debian-User	pollo
X-Mailing-List	<debian-python@lists.debian.org> archive/latest/22377
List-ID	<debian-python.lists.debian.org>
List-URL	<https://lists.debian.org/debian-python/>
List-Archive	https://lists.debian.org/msgid-search/c93cb2bd-ad10-439e-819b-0007bf60fadc@debian.org
Approved	robomod@news.nic.it
Lines	17
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Thu, 3 Oct 2024 14:22:09 -0400
X-Original-Message-ID	<c93cb2bd-ad10-439e-819b-0007bf60fadc@debian.org>
X-Original-References	<14198883.O9o76ZdvQC@galatea> <87bk04sslp.fsf@debian.org> <4017015.ElGaqSPkdT@galatea> <20241003152912.7wwrsuxezwg3kaoj@satie.tumbleweed.org.za>
Xref	csiph.com linux.debian.maint.python:16316

Show key headers only | View raw

On 2024-10-03 11:29, Stefano Rivera wrote:
> We should figure out what it would take to support sigstore in Debian
> source packages, assuming there is more adoption.

Having that support in uscan and the rest of our tooling would be amazing.

That would let us support things like SSH signatures, like I encountered 
in #1023140.

In general, having viable alternatives to OpenPGP would open an 
interesting door for the general Debian ecosystem...

-- 
   ⢀⣴⠾⠻⢶⣦⠀
   ⣾⠁⢠⠒⠀⣿⡁  Louis-Philippe Véronneau
   ⢿⡄⠘⠷⠚⠋   pollo@debian.org / veronneau.org
   ⠈⠳⣄

Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

python devs are planning to stop signing with gpg Salvo Tomaselli <ltworf@debian.org> - 2024-09-30 23:50 +0200
  Re: python devs are planning to stop signing with gpg Salvo Tomaselli <ltworf@debian.org> - 2024-10-01 00:20 +0200
    Re: python devs are planning to stop signing with gpg Brian May <bam@debian.org> - 2024-10-01 02:00 +0200
    Re: python devs are planning to stop signing with gpg Stefano Rivera <stefanor@debian.org> - 2024-10-03 17:30 +0200
      Re: python devs are planning to stop signing with gpg Louis-Philippe Véronneau <pollo@debian.org> - 2024-10-03 20:30 +0200
        Re: python devs are planning to stop signing with gpg Jeremy Stanley <fungi@yuggoth.org> - 2024-10-03 22:30 +0200
        Alternative signature mechanisms for upstream source verification Stefano Rivera <stefanor@debian.org> - 2024-10-04 20:30 +0200
          Re: Alternative signature mechanisms for upstream source  verification Mathias Behrle <mbehrle@debian.org> - 2024-10-04 21:30 +0200
          Re: Alternative signature mechanisms for upstream source verification Guillem Jover <guillem@debian.org> - 2024-10-05 03:40 +0200
            Re: Alternative signature mechanisms for upstream source verification Stefano Rivera <stefanor@debian.org> - 2024-10-05 06:10 +0200
            Re: Alternative signature mechanisms for upstream source verification Martin <debacle@debian.org> - 2024-10-05 10:30 +0200
          Re: Alternative signature mechanisms for upstream source verification Simon Josefsson <simon@josefsson.org> - 2024-10-05 12:40 +0200
  Re: python devs are planning to stop signing with gpg Brian May <bam@debian.org> - 2024-10-01 00:30 +0200

csiph-web