On 2023-11-15 11:01:35 +0100 (+0100), Salvo Tomaselli wrote: [...] > I was recently discussing with pypi and core python developers, > and it seems that their take is very different than ours. > > It seems that pypi completely removed support for signed updates, > and instead now verification happens if you upload from a github > pipeline. > > It has been suggested that I'm a bit paranoid for stating that > putting my private key on a microsoft server renders the signature > with that key completely meaningless. > > I of course disagree, but the opinion of people in such key > positions is easily valued more. > > Perhaps we need an explicit policy in how to handle keys, since > there are very different opinions about what it is ok to do with > them. I replied to you there too, but you still never seemed to be able to explain... why do you need to put an OpenPGP key on the service you're using to upload Python packages (not Debian packages) to PyPI, given that PyPI doesn't support uploading OpenPGP signatures anyway? If you're equating PyPI's "trusted publishers" feature with signing packages, you've misunderstood the intent. It's a way of delegating upload authentication to public identity providers in order to better secure upload automation in CI systems (in lieu of giving them a fixed username+password or long-lived API token): https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/ If you're going to be concerned about something with that particular feature, I think it should probably be that they've so far only implemented support for GitHub Actions; though it sounds like they're willing to entertain other authentication providers if someone is interested enough to write the necessary drivers/config for them. But to reiterate, PyPI's old "you can upload detached signatures" feature was never used to authenticate anything, it served an entirely different purpose. The "trusted publishers" feature really has no similarity with it whatsoever. Yes I'm also annoyed that they saw no value in software authors uploading signatures for their release artifacts, I argued repeatedly in favor of keeping it, but the PyPI maintainers (rightly or wrongly) saw it as a mostly-unused attractive nuisance, and assert that their more recent addition of HTTPS and strong checksums mostly serves the purpose of users being able to double-check that what they downloaded is what PyPI meant to serve them (even if they can't as easily double-check that what they downloaded is what the author believes was originally uploaded). -- Jeremy Stanley
Attachment:
signature.asc
Description: PGP signature