Path: csiph.com!goblin1!goblin2!goblin.stu.neva.ru!aioe.org!bofh.it!news.nic.it!robomod From: Donald Stufft Newsgroups: linux.debian.maint.python Subject: Re: the new PyPI, coming next month Date: Sun, 01 Apr 2018 15:40:01 +0200 Message-ID: References: X-Original-To: Dominik George X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Apr 1 13:39:35 2018 Old-Return-Path: X-Amavis-Spam-Status: No, score=-5.7 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, EMPTY_BODY=3, FOURLA=0.1, HTML_MESSAGE=2, LDO_WHITELIST=-5, PGPSIGNATURE=-5, PUSSY=2, RCVD_IN_DNSWL_LOW=-0.7] autolearn=no autolearn_force=no X-Policyd-Weight: using cached result; rate: -7 Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stufft.io; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= mesmtp; bh=59Gmr5xyGhQOTy0pj7R+qadD+DN/F5pJBQ/VUZXvABc=; b=eYT4B Ic67KKZK4t8SM2cMCr28wChcuNX6z0GI+nqCVYc7cgU9ReOUeLehtS4K/hxG6XUD G3ub+OSsJoDCYYexranBJGSTxGM8d37z+D/oKU9sbltzuAaWEh8WFWY/EzVmeCL7 zWNYEM1M7pGJR4TvtJjmxavHtC5YMjKWdEiLrc= Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=59Gmr5xyGhQOTy0pj7R+qadD+DN/F 5pJBQ/VUZXvABc=; b=O5lHbseI1WmhfOI7NrjnfOwdJFio2yGUIE0BDHMioGHes AsYwLU4a6mGJHmlMH5hFzaMvMClHbAqXH4EgdKGwNeGND6/FE6b4AuYpy3cH7Xqb If6nKmhcTS+rC5MFJT3fsgOVPTo0unPRxQQQL7HznXd7kHo+KFz4oF3KNzzQgK3P 8twzyPeuoAcywzRzTULTYsmygovRo7QllFuMiX2Acsp5UJk/tSsDXdQb7gPu2Q2b RKxwfGyskSvDpIhxjQQ8t4Vq6rNHlhK+IIRGMZXad3YMYedl66wh2PpWYWv1OotZ uZHgm+sxlb30XxqsJR8cID7XkR6rbNwsHiDM5a2ag== X-Me-Sender: Content-Type: multipart/signed; boundary="Apple-Mail=_1EEFE4E8-B5E2-4187-ABB1-9F30A96B1558"; protocol="application/pgp-signature"; micalg=pgp-sha512 MIME-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) X-Mailer: Apple Mail (2.3445.5.20) X-Mailing-List: archive/latest/15765 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/0F7A4E4F-A49A-4F98-A334-BE039C9EB9B9@stufft.io Approved: robomod@news.nic.it Lines: 161 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org, Sumana Harihareswara X-Original-Date: Sun, 1 Apr 2018 09:39:13 -0400 X-Original-Message-ID: <0F7A4E4F-A49A-4F98-A334-BE039C9EB9B9@stufft.io> X-Original-References: <7236AF0E-DA5C-45B9-AA78-5BCF900D7846@stufft.io> <20180401062709.GB10210@portux.lan.naturalnet.de> Xref: csiph.com linux.debian.maint.python:10365 --Apple-Mail=_1EEFE4E8-B5E2-4187-ABB1-9F30A96B1558 Content-Type: multipart/alternative; boundary="Apple-Mail=_DA29CDB3-CE12-466F-8D30-9A0AE6D28F79" --Apple-Mail=_DA29CDB3-CE12-466F-8D30-9A0AE6D28F79 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Apr 1, 2018, at 2:27 AM, Dominik George = wrote: >=20 > Hi, >=20 >> To be clear, PGP signatures can still be uploaded and they are still >> available for download, they just don=E2=80=99t appear in the UI = anymore. >=20 > So, what does the pypi.debian.net redirector use for uscan? I imagine = it > used to scrape the website. Can it be changed to use the JSON API? The original PoC I wrote used the JSON API, but I don=E2=80=99t think = what=E2=80=99s being deployed is descendant from my PoC so I have no = idea what it uses, but if it=E2=80=99s not using the JSON API then yes = it can be. >=20 >> Longer term I=E2=80=99d *like* to get rid of PGP signatures, because = I think >> their value here is actually pretty low. >=20 > I partially share this opinion, but that's a question to be discusses = with > the Debian policy people in general. While checking a GPG signature = on the > source tarball in general is a good idea, I am afraid some developers = just > drop any key they find on first glance into the package and are done = with > it, which actually provides nothing but a false sense of safety. >=20 >> In that case they=E2=80=99d be replaced with TUF, but that=E2=80=99s = a longer term >> project. >=20 > That one?: https://github.com/theupdateframework/tuf = Yes. >=20 > Well, I can only say *please* do not remove the possibility to upload = signed > source tarballs, but leave that to the developers! >=20 > -nik >=20 > -- > PGP-Fingerprint: 3C9D 54A4 7575 C026 FB17 FD26 B79A 3C16 A0C4 F296 >=20 > Dominik George =C2=B7 Hundeshagenstr. 26 =C2=B7 53225 Bonn > Phone: +49 228 92934581 =C2=B7 https://www.dominik-george.de/ >=20 > Teckids e.V. =C2=B7 FrOSCon e.V. =C2=B7 Debian Developer >=20 > LPIC-3 Linux Enterprise Professional (Security) --Apple-Mail=_DA29CDB3-CE12-466F-8D30-9A0AE6D28F79 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Apr 1, 2018, at 2:27 AM, Dominik George <natureshadow@debian.org> wrote:

Hi,
To be = clear, PGP signatures can still be uploaded and they are still
available for download, they just don=E2=80=99t appear in the = UI anymore.

So, what does the = pypi.debian.net = redirector use for uscan?  I imagine it
used to = scrape the website.  Can it be changed to use the JSON API?

The = original PoC I wrote used the JSON API, but I don=E2=80=99t think = what=E2=80=99s being deployed is descendant from my PoC so I have no = idea what it uses, but if it=E2=80=99s not using the JSON API then yes = it can be.


Longer term I=E2=80=99d *like* to get rid of PGP signatures, = because I think
their value here is actually pretty = low.

I partially share this = opinion, but that's a question to be discusses with
the = Debian policy people in general.  While checking a GPG signature on = the
source tarball in general is a good idea, I am afraid = some developers just
drop any key they find on first = glance into the package and are done with
it, which = actually provides nothing but a false sense of safety.

In that case they=E2=80=99= d be replaced with TUF, but that=E2=80=99s a longer term
project.

That one?: = https://github.com/theupdateframework/tuf


Yes.



Well, I can only say *please* do not remove = the possibility to upload signed
source tarballs, but = leave that to the developers!

-nik

--
PGP-Fingerprint: 3C9D 54A4 = 7575 C026 FB17  FD26 B79A 3C16 A0C4 F296

Dominik George =C2=B7 Hundeshagenstr. 26 =C2=B7 53225 Bonn
Phone: +49 228 92934581 =C2=B7 https://www.dominik-george.de/

Teckids e.V. =C2=B7 FrOSCon e.V. =C2=B7 Debian Developer

LPIC-3 Linux Enterprise Professional = (Security)

= --Apple-Mail=_DA29CDB3-CE12-466F-8D30-9A0AE6D28F79-- --Apple-Mail=_1EEFE4E8-B5E2-4187-ABB1-9F30A96B1558 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIzBAEBCgAdFiEEfGt8XV4rY1apJvBPbjy86TNy3PoFAlrA4QEACgkQbjy86TNy 3PrWOg//QlIQwxaXswD+E2HIgy8+j+G9L62ayMqkF1+vgeQGEeGlbwhtE5HZ4Rn0 UmGwHVFXf69doSb4/QzNJf1Jk0wM+1Bi3PN/LpACrU7hj7ZZwcm6bJTXOE5626hl P0tb2ncNOFpDL+363IED//IRYTrTDQnViWCLnVCO2cVWSOlOd3hFWYcPuVUks0Y4 xp+7kaPGO+e2Je4AKT+i+z/q2gmru1tnMvMzTkDY9y7/tGveZXnFyA/3rK6Q8exg iAaIaijx6XeznIR24tX51/yHGcdkezdb3qhYEFYlS9FxvHRf6zkSf0fddB2PYmLC an9OZTkOsM4BDQdxPVs2SrfmwhPwoe9FnPwuOUywrO2RSRyxqaaWS/nOD/6C9AfE a7cbjuLCQMg+Z1BzlnBs2ZteLAUgF1g+FXqFKi6LTH12E0Y1ftIzQepqIETE9RNU T76LWDhR4TrR8KIj2VZNvJbbvVwkSEmr3CdAgtWtotJXjerMf7ZnWWy2XP65OTBv S3HsFFkaJ6eAxvyRNHx2FTPucOwM3wNpPU7GzAzGP41KWkJsrw8c/FDo/xbJpQ7t OYy2pbk2WredIwJtPf65BIqPW3U74VVYWe67DWe9bA8hDdt2qmQtasoLdWvb0Nps Ns5UD6Sn4XCPky204xTgtzk2GR72NdUec8utpvo6t8kGpRns8sw= =MIT8 -----END PGP SIGNATURE----- --Apple-Mail=_1EEFE4E8-B5E2-4187-ABB1-9F30A96B1558--