3 ms·
What happens if the developer looses his key? Or if it expires? pypi could show a warning that the key has changed. Which is not an actionable or helpful warni
by hannob 3y ago
What happens if the developer looses his key? Or if it expires?
pypi could show a warning that the key has changed. Which is not an actionable or helpful warning. And then everyone gets used to seeing these warnings every now and then. And you won nothing.
Getting signatures to do something useful is hard.
- bombolo 3y ago> What happens if the developer looses his key? Or if it expires? What happens if a developer loses their google titan key that is required to login into pypi?
- hannob 3y agoThey either have their backup codes or there's probably a manual process the pypi team can get them their account back if they can sufficiently show they are the real developers. If you have any form of automated signature verification you basically need a concept how to handle recovery. But if this concept comes down to "trust pypi", then you really can just skip the whole thing and rely on pypi giving you the right packages and https to secure the connection).