News for hackers. Stuff that matters.

A comment on PGP signatures on PyPI: worse than useless.

Re:PGP signatures on PyPI: worse than useless by 8organicbits on Sunday May 21, 2023 @12:32PM (#36022541)
I've been watching sigstore [1] as a better approach to signing artifacts. Anyone have experience using it with python?

[1] https://www.sigstore.dev/

[ Parent | on HN ]
Re:PGP signatures on PyPI: worse than useless by ewdurbin on Sunday May 21, 2023 @01:15PM (#36022938)
Python release files have been signed with sigstore for the last couple versions. You can peruse the release tooling that uses it at https://github.com/python/release-tools
[ Parent | on HN ]