Groups > linux.debian.maint.python > #10363

Re: the new PyPI, coming next month

Path	csiph.com!goblin3!goblin2!goblin.stu.neva.ru!aioe.org!bofh.it!news.nic.it!robomod
From	Dominik George <natureshadow@debian.org>
Newsgroups	linux.debian.maint.python
Subject	Re: the new PyPI, coming next month
Date	Sun, 01 Apr 2018 08:30:01 +0200
Message-ID	<vzEF3-7zt-3@gated-at.bofh.it> (permalink)
References	<vzB4t-5b9-7@gated-at.bofh.it> <vzBQS-5JA-11@gated-at.bofh.it> <vzC0y-5ML-1@gated-at.bofh.it>
X-Mailbox-Line	From debian-python-request@lists.debian.org Sun Apr 1 06:27:42 2018
Old-Return-Path	<SRS0=H/iB=GW=debian.org=natureshadow@naturalnet.de>
X-Amavis-Spam-Status	No, score=-9.9 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FOURLA=0.1, LDO_WHITELIST=-5, PGPSIGNATURE=-5, PUSSY=2] autolearn=ham autolearn_force=no
X-Policyd-Weight	DYN_NJABL=SKIP(0) NOT_IN_SBL_XBL_SPAMHAUS=-1.5 BL_NJABL=SKIP(-1.5) CL_IP_EQ_FROM_MX=-3.1; rate: -6.1
Old-X-Envelope-From	<natureshadow@debian.org>
MIME-Version	1.0
Content-Type	multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="tjCHc7DPkfUGtrlw"
Content-Disposition	inline
Jabber-ID	nik@naturalnet.de
Openpgp	id=3C9D54A47575C026FB17FD26B79A3C16A0C4F296; preference=signencrypt
Organization	Debian
User-Agent	Mutt/1.9.4 (2018-02-28)
X-Mailing-List	<debian-python@lists.debian.org> archive/latest/15763
List-ID	<debian-python.lists.debian.org>
List-URL	<https://lists.debian.org/debian-python/>
List-Archive	https://lists.debian.org/msgid-search/20180401062709.GB10210@portux.lan.naturalnet.de
Approved	robomod@news.nic.it
Lines	67
Sender	robomod@news.nic.it
X-Original-Cc	debian-python@lists.debian.org, Sumana Harihareswara <sh@changeset.nyc>
X-Original-Date	Sun, 1 Apr 2018 08:27:09 +0200
X-Original-Message-ID	<20180401062709.GB10210@portux.lan.naturalnet.de>
X-Original-References	<b06878cc-90f6-d033-4fdd-fa191db6c083@changeset.nyc> <E695279A-7F89-4973-933B-CEAD4455DF3F@kitterman.com> <7236AF0E-DA5C-45B9-AA78-5BCF900D7846@stufft.io>
Xref	csiph.com linux.debian.maint.python:10363

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

> To be clear, PGP signatures can still be uploaded and they are still
> available for download, they just don’t appear in the UI anymore.

So, what does the pypi.debian.net redirector use for uscan?  I imagine it
used to scrape the website.  Can it be changed to use the JSON API?

>  Longer term I’d *like* to get rid of PGP signatures, because I think
> their value here is actually pretty low.

I partially share this opinion, but that's a question to be discusses with
the Debian policy people in general.  While checking a GPG signature on the
source tarball in general is a good idea, I am afraid some developers just
drop any key they find on first glance into the package and are done with
it, which actually provides nothing but a false sense of safety.

> In that case they’d be replaced with TUF, but that’s a longer term
> project.

That one?: https://github.com/theupdateframework/tuf

Well, I can only say *please* do not remove the possibility to upload signed
source tarballs, but leave that to the developers!

-nik

-- 
PGP-Fingerprint: 3C9D 54A4 7575 C026 FB17  FD26 B79A 3C16 A0C4 F296

Dominik George · Hundeshagenstr. 26 · 53225 Bonn
Phone: +49 228 92934581 · https://www.dominik-george.de/

Teckids e.V. · FrOSCon e.V. · Debian Developer

LPIC-3 Linux Enterprise Professional (Security)

Thread

the new PyPI, coming next month Sumana Harihareswara <sh@changeset.nyc> - 2018-04-01 04:40 +0200
  Re: the new PyPI, coming next month Scott Kitterman <debian@kitterman.com> - 2018-04-01 05:30 +0200
    Re: the new PyPI, coming next month Donald Stufft <donald@stufft.io> - 2018-04-01 05:40 +0200
      Re: the new PyPI, coming next month Dominik George <natureshadow@debian.org> - 2018-04-01 08:30 +0200
        Re: the new PyPI, coming next month Donald Stufft <donald@stufft.io> - 2018-04-01 15:40 +0200
    Re: the new PyPI, coming next month Sumana Harihareswara <sh@changeset.nyc> - 2018-04-01 05:50 +0200
  Re: the new PyPI, coming next month Sumana Harihareswara <sh@changeset.nyc> - 2018-04-01 13:20 +0200
    Re: the new PyPI, coming next month Sumana Harihareswara <sh@changeset.nyc> - 2018-04-03 15:40 +0200

csiph-web