Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod From: Donald Stufft Newsgroups: linux.debian.maint.python Subject: Re: the new PyPI, coming next month Date: Sun, 01 Apr 2018 05:40:02 +0200 Message-ID: References:

X-Original-To: Scott Kitterman X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Apr 1 03:33:50 2018 Old-Return-Path: X-Amavis-Spam-Status: No, score=-0.8 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, EMPTY_BODY=3, HTML_MESSAGE=2, LDO_WHITELIST=-5, PUSSY=2, RCVD_IN_DNSWL_LOW=-0.7] autolearn=no autolearn_force=no X-Policyd-Weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_BL_NJABL=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .stufft. - helo: .out5-smtp.messagingengine. - helo-domain: .messagingengine.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -7 Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stufft.io; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=K1b2mwPcyRcD3FYu5EPNv4XwUILM6C4HAkl3cArgNDY=; b=N9Bko Xfkf4f74nDVH0m1RJ+lUk2w4D5KC9t79htBJpun38uyNu+BpxzRxIuWow7HOpEmG akkfZoshd8ttWg9lz1PU449OcoZrK2ooB+ahXfcV73f5RySP1d/53YlbtYaNEZcz xAsim6A2S8m4c99et39Bix191tPR3mw1304USY= Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=K1b2mwPcyRcD3FYu5EPNv4XwUILM6 C4HAkl3cArgNDY=; b=mDcsWQG1mwWENRc0VpNa5nLDxK8uPVu7aPv4WjejzutY6 s8sSXe+rKUl4/MYbfrTOBe8RwLfFjpcFxctCmMzpMPrYge6+zaeNNhdlu4yPYi6p nqIRor2GsinOfJkz+ofryaf+89QCI088UOQJ0x14+oypQ03yjeTzkkxfwVeSezHb IRT489b6s6MGhuZPnrOKCyj9ugRhgYlSQeFNTgTnLs6oARDN9AnYVoA5NQNkUypB fO15sqW7mZbSO6nPRHQPz3cSI8Nf5g863Y8HsK3daGrViMVjr+PMBW5LvokMKfRi DhUuMCF8Hk7xluZ7ydgD+4GSc0ocaKSmzHF6x0m+g== X-Me-Sender: Content-Type: multipart/alternative; boundary="Apple-Mail=_1A0AA59C-6AD8-476B-A265-D0E254E06673" MIME-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) X-Mailer: Apple Mail (2.3445.5.20) X-Mailing-List: archive/latest/15761 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/7236AF0E-DA5C-45B9-AA78-5BCF900D7846@stufft.io Approved: robomod@news.nic.it Lines: 48 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org, Sumana Harihareswara X-Original-Date: Sat, 31 Mar 2018 23:33:26 -0400 X-Original-Message-ID: <7236AF0E-DA5C-45B9-AA78-5BCF900D7846@stufft.io> X-Original-References:

Xref: csiph.com linux.debian.maint.python:10361 --Apple-Mail=_1A0AA59C-6AD8-476B-A265-D0E254E06673 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Mar 31, 2018, at 11:23 PM, Scott Kitterman = wrote: >=20 > What replaces gpg for ensuring integrity of the uploaded code? To be clear, PGP signatures can still be uploaded and they are still = available for download, they just don=E2=80=99t appear in the UI = anymore. Longer term I=E2=80=99d *like* to get rid of PGP signatures, = because I think their value here is actually pretty low. In that case = they=E2=80=99d be replaced with TUF, but that=E2=80=99s a longer term = project.= --Apple-Mail=_1A0AA59C-6AD8-476B-A265-D0E254E06673 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On = Mar 31, 2018, at 11:23 PM, Scott Kitterman <debian@kitterman.com> wrote:

What replaces gpg for ensuring = integrity of the uploaded code?

To be = clear, PGP signatures can still be uploaded and they are still available = for download, they just don=E2=80=99t appear in the UI anymore. Longer = term I=E2=80=99d *like* to get rid of PGP signatures, because I think = their value here is actually pretty low. In that case they=E2=80=99d be = replaced with TUF, but that=E2=80=99s a longer term = project.

= --Apple-Mail=_1A0AA59C-6AD8-476B-A265-D0E254E06673--