3 ms·
So to check your keys, you are asked to grab a pip package. That is OK, but I heard there were lots of security issues with pips too. From one issue to maybe
by jmclnx 2y ago
So to check your keys, you are asked to grab a pip package.
That is OK, but I heard there were lots of security issues with pips too. From one issue to maybe another ?
If you are worried, I would just recreate your keys.
- westurner 2y agoPyPI has only implemented the "server signs whatever's uploaded with that account" part of TUF; there are no Publisher Signatures for packages uploaded to pypi (because GPG ASC support was removed from PyPI, the ad-hoc signature support was removed from wheel, and only server signatures are yet implemented). https://SLSA.dev/ https://SLSA.dev/ recommends TUF and Sigstore.dev and trusted containers for build-signing. Someday, Twine should prompt a PyPI package uploader to sign the package before uploading it, and download it to (prime the CDN cache and) check the Publisher and Package repo signature(s) at least once.
- woodruffw 2y agoPyPI doesn’t currently implement any part of TUF in a public facing manner, so I’m not sure where you got that from :-). There’s some limited deployment experiments with rstuf, but these are not part of any current server-side package signing scheme. PEP 740 does the rest of what you’ve described, however. And twine already has initial support for it, although it isn’t part of a release yet.
- westurner 2y ago"Roadmap for PEP 458" https://github.com/pypi/warehouse/issues/10672 https://github.com/pypi/warehouse/issues/10672