4 ms·
> Having a quick way to sign your package to send it so pypi would be a great thing. I guess we just need to make signing easy then. Which remains a hard prob
by nibbleshifter 4y ago
> Having a quick way to sign your package to send it so pypi would be a great thing.
I guess we just need to make signing easy then.
Which remains a hard problem.
- dlor 4y agoWe've been working with PyPI to help integrate Sigstore, which makes signing (and verification) easier! sigstore.dev
- nibbleshifter 4y agoI'll have to check out sigstore. Anything that makes signing/verifying easier is a welcome change.
- BiteCode_dev 4y agoWe used to say that about https, and now we got letsencrypt.
- nibbleshifter 4y agoLE made SSL/TLS easy, we need something similar for sign/verify of packages/software. Another commenter mentioned sigstore.dev which looks potentially interesting.
- Tainnor 4y agoWhat, exactly, is hard about signing?