Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PEP 480: update distribution upload steps #1912

Closed
brainwane opened this issue Apr 5, 2021 · 2 comments
Closed

PEP 480: update distribution upload steps #1912

brainwane opened this issue Apr 5, 2021 · 2 comments

Comments

@brainwane
Copy link
Contributor

@mnm678 The section about PyPI users registering projects prior to uploading

peps/pep-0480.txt

Lines 380 to 395 in e2b198b

The following outlines an automated signing solution that a new developer MAY
follow to upload a distribution to PyPI:
1. Register a PyPI project.
2. Enter a secondary password (independent of the PyPI user account password).
3. Optional: Add a new identity to the developer's PyPI user account from a
second machine (after a password prompt).
4. Upload project.
Step 1 is the normal procedure followed by developers to `register a PyPI
project`__.
__ https://pypi.python.org/pypi?:action=register_form
Step 2 generates an encrypted key file (private), uploads an Ed25519 public key
to PyPI, and signs the TUF metadata that is generated for the distribution.

is now obsolete and needs to be updated before or as we re-start deliberations on this PEP.

Originally posted by @brainwane in #1693 (comment)

@mnm678
Copy link
Contributor

mnm678 commented Apr 8, 2021

This is partly addressed in #1711, although using Fulcio identities for developer key management, as proposed by @joshuagl here, would reduce the overhead for PyPI and further simplify these steps.

@brettcannon
Copy link
Member

We try to keep this issue repository just for the repo itself and not the individual PEPs (too many of them for us to be a central clearinghouse for that sort of thing). I would email the PEP authors to find out where they want feedback to go.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants