4 ms·

On the same topic, PyPI has recently moved to a new backend, and in the process all end-to-end PGP signatures (created by the package owner upstream, proving th

On the same topic, PyPI has recently moved to a new backend, and in the process all end-to-end PGP signatures (created by the package owner upstream, proving that no tampering happened on the online servers) have disappeared from the UI, and that is seen as a "feature": https://github.com/pypa/warehouse/issues/3356 https://github.com/pypa/warehouse/issues/3356 You can still get them through some obscure API and you still need to know the right PGP key for verification, but this really signals the lack of consensus and awareness on the path toward a secure software supply chain. EDIT: typos

llampx 8y ago
It is the appification of software development.
egjerlow 8y ago
FWIW, here is a blog post by dstufft which might help contextualize this behaviour: https://caremad.io/posts/2013/07/packaging-signing-not-holy-grail/ https://caremad.io/posts/2013/07/packaging-signing-not-holy-...
- msl09 8y ago
  That is discussed extensively in the issues related to the OP. The problem is that package maintainers of distros actually check whether the GPG signature has changed in order to repackaged python projects for their distros.
  - x1798DE 8y ago
    They can still do that, it's just not exposed in the UI anymore.
    - msl09 8y ago
      I have tried checking the REST API[1] but I only found a has_sig parameter. Where is the actual signature? https://warehouse.readthedocs.io/api-reference/json/ https://warehouse.readthedocs.io/api-reference/json/
      - dralley 8y ago
        On the package?
      - Sean1708 8y ago
        It's not particularly obvious, but you find a release for which `has_sig` is true then you take the URL from that release and append `.asc` to that URL. $ curl -s $(curl -s https://pypi.org/pypi/cryptography/json | jq '.releases["2.2.2"][] | select(.has_sig) | .url' | sed -e 's/^"//' -e 's/"$//').asc -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEBf2foWz3VzUNkaVgI1rl8Sn57ZgFAlq6dNgACgkQI1rl8Sn5 7Zg0Ygf/WzulfXom9qdbCHrUJh2xkTxPqK2/SUqDqOQ1OdKJm+MxDBcMhwrCdBDh 8+eXyPTLnnhPUcCSqVFcJeUu9KyKB2MhKi7gdBUHrDxjbufexxPC+L/KwjOq3nod gL4OPHGGeX2ZgSlwFPR4zPIIheUmf9kPX88qtW8DD8zmuyhci6ibac9a/3fHkDVt H27B+aqs+WObMjcfwZV7gMnRbZwUOBZvVFRxwfMHVuMpfbwhQC8HdBK74XKNaoTd Golmpa5fqRm1sNquBz9YRVElWuw1qj1CZJhRBuR7V5xyPLX8J7EVUrYa70/fVtfr hW7oAlNbMFYb58hGC9K20v6WX8XT2w== =zox2 -----END PGP SIGNATURE----- At least that's what I was able to piece together from the docs...
        deleted 8y ago
        [deleted]
  - jonathonf 8y ago
    Why are distros packaging from PyPI and not from the upstream project?
    - jwilk 8y ago
      Because that's where upstream puts release tarballs.
evancordell 8y ago
I’m not sure what the implementation status is, but PEP 458 and 480 define how to integrate TUF with PyPI. It could be that pgp is being de-emphasized in favor of TUF? (A quick search couldn’t tell me the integration status or if there are still plans to do so, but I’m familiar with the pypi plans from the TUF side)
Sir_Cmpwn 8y ago
They've also repeatedly broken having predictable tarball download URLs, which makes it harder still to make Python packages for distros, and dismissed it as by design. Package managers shouldn't have to implement Python-specific API adapters just to find tarballs and signatures. The Warehouse team seems more concerned with a pretty UI than a working platform.
- jwilk 8y ago
  https://github.com/pypa/pypi-legacy/issues/438 https://github.com/pypa/pypi-legacy/issues/438 There's a redirector that is supposed to provide stable URLs, although IME it doesn't work immediately after upload, which is when I need it most. :-/

llampx 8y ago

It is the appification of software development.

egjerlow 8y ago

FWIW, here is a blog post by dstufft which might help contextualize this behaviour: https://caremad.io/posts/2013/07/packaging-signing-not-holy-grail/ https://caremad.io/posts/2013/07/packaging-signing-not-holy-...

msl09 8y ago
That is discussed extensively in the issues related to the OP. The problem is that package maintainers of distros actually check whether the GPG signature has changed in order to repackaged python projects for their distros.
- x1798DE 8y ago
  They can still do that, it's just not exposed in the UI anymore.
  - msl09 8y ago
    I have tried checking the REST API[1] but I only found a has_sig parameter. Where is the actual signature? https://warehouse.readthedocs.io/api-reference/json/ https://warehouse.readthedocs.io/api-reference/json/
    - dralley 8y ago
      On the package?
    - Sean1708 8y ago
      It's not particularly obvious, but you find a release for which `has_sig` is true then you take the URL from that release and append `.asc` to that URL. $ curl -s $(curl -s https://pypi.org/pypi/cryptography/json | jq '.releases["2.2.2"][] | select(.has_sig) | .url' | sed -e 's/^"//' -e 's/"$//').asc -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEBf2foWz3VzUNkaVgI1rl8Sn57ZgFAlq6dNgACgkQI1rl8Sn5 7Zg0Ygf/WzulfXom9qdbCHrUJh2xkTxPqK2/SUqDqOQ1OdKJm+MxDBcMhwrCdBDh 8+eXyPTLnnhPUcCSqVFcJeUu9KyKB2MhKi7gdBUHrDxjbufexxPC+L/KwjOq3nod gL4OPHGGeX2ZgSlwFPR4zPIIheUmf9kPX88qtW8DD8zmuyhci6ibac9a/3fHkDVt H27B+aqs+WObMjcfwZV7gMnRbZwUOBZvVFRxwfMHVuMpfbwhQC8HdBK74XKNaoTd Golmpa5fqRm1sNquBz9YRVElWuw1qj1CZJhRBuR7V5xyPLX8J7EVUrYa70/fVtfr hW7oAlNbMFYb58hGC9K20v6WX8XT2w== =zox2 -----END PGP SIGNATURE----- At least that's what I was able to piece together from the docs...
      - deleted 8y ago
        [deleted]
- jonathonf 8y ago
  Why are distros packaging from PyPI and not from the upstream project?
  - jwilk 8y ago
    Because that's where upstream puts release tarballs.

evancordell 8y ago

I’m not sure what the implementation status is, but PEP 458 and 480 define how to integrate TUF with PyPI. It could be that pgp is being de-emphasized in favor of TUF? (A quick search couldn’t tell me the integration status or if there are still plans to do so, but I’m familiar with the pypi plans from the TUF side)

Sir_Cmpwn 8y ago

They've also repeatedly broken having predictable tarball download URLs, which makes it harder still to make Python packages for distros, and dismissed it as by design. Package managers shouldn't have to implement Python-specific API adapters just to find tarballs and signatures. The Warehouse team seems more concerned with a pretty UI than a working platform.

jwilk 8y ago
https://github.com/pypa/pypi-legacy/issues/438 https://github.com/pypa/pypi-legacy/issues/438 There's a redirector that is supposed to provide stable URLs, although IME it doesn't work immediately after upload, which is when I need it most. :-/