3 ms·
We need the GPG feature in pip to be finished. We can currently upload signed packages, but pip won't check if you thrust the keys. Pip should include a keyring
by 1337shadow 4y ago
We need the GPG feature in pip to be finished. We can currently upload signed packages, but pip won't check if you thrust the keys. Pip should include a keyring system and prevent people from installing packages without a signature that has a certain thrust level without explicit whitelist or interactivity.
- yrro 4y agoUnbelievable that a major packaging ecosystem still has no mechanism for end-to-end signature verification!
- 1337shadow 4y agoApparently they are working on it in PEP-480