3 ms·
I'm confused as to why package signing isn't standard for all package managers. Didn't Pypi just remove signing too?
by thewataccount 3y ago
I'm confused as to why package signing isn't standard for all package managers.
Didn't Pypi just remove signing too?
- bravetraveler 3y agoPyPi did indeed, but it's a fairly interesting case. It was removed because the implementation was ineffective More information on that here: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI-worse-than-useless https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI... There was a lot of talk about why this didn't go the other way; keeping signing, but making the practice meaningful. I forget the details about that.