Removing PGP from PyPI – The Python Package Index

Re:Removing PGP from PyPI – The Python Package Index by bryanlyon on Tuesday May 23, 2023 @12:59PM (#36047199)

I came here thinking they were removing the PGP package from PyPi, but they're just removing a barely-used signature system? I don't know why they have to remove it though. I doubt it requires much maintenance now that it's already in place.

Even if only 37% of keys are verifiable, that's infinitely more than will be verifiable if they remove the PGP support.

[ Parent | on HN ]

Re:Removing PGP from PyPI – The Python Package Index by tedivm on Tuesday May 23, 2023 @01:01PM (#36047236)

They address your comment directly in their post-

> While it doesn't represent a massive operational burden to continue to support it, it does require any new features that touch the storage of files to be made aware of and capable of handling these PGP signatures, which is a non zero cost on the maintainers and contributors of PyPI.

[ Parent | on HN ]

Re:Removing PGP from PyPI – The Python Package Index by Avamander on Tuesday May 23, 2023 @01:01PM (#36047234)

> Even if only 37% of keys are verifiable, that's infinitely more than will be verifiable if they remove the PGP support.

Discoverable. That does not really verify anything about the key, its identities or the supposed signer.

It boils down to almost entirely to just an overcomplicated hashing system.

[ Parent | on HN ]