PEP 480: Clarify automated signing solution to remove key sharing #1711
Conversation
|
@pfmoore we should probably change the PEP delegate for this PEP. |
|
Agreed. As it's a PyPI related PEP, it should probably be @dstufft. |
|
@brainwane opened a pr to change the delegate in #1693. |
| metadata that PyPI then signs. After the initial trust is established, | ||
| developers are required to sign distributions that they upload to PyPI using | ||
| the public key's corresponding private key. The signed TUF metadata that | ||
| at least one public key's corresponding private key. The signed TUF metadata that |
| metadata that PyPI then signs. After the initial trust is established, | ||
| developers are required to sign distributions that they upload to PyPI using | ||
| the public key's corresponding private key. The signed TUF metadata that | ||
| at least one public key's corresponding private key. The signed TUF metadata that |
|
@dstufft could I ask you to please review this? Thanks! |
|
@dstufft ping to please review this to unblock relevant work I will be getting into soonish. Thank you. |
|
Hey @brainwane , is this still active? We can review and merge it from a PEP editor perspective, though we're not subject matter experts like @dstufft . Let us know, thanks! |
|
@CAM-Gerlach Yes, this change is still active; please go ahead and merge it, and we'll move forward on further discussions of PEP 480 in the relevant Discourse thread. Thank you! |
This commit adds an additional step to the automated signing solution to allow multiple developers to upload keys for the same package if they are maintainers of the package. This removes the need to share keys between developers. An alternative would be to allow each project to delegate to separate developers. However, this solution would require uploading additional targets metadata which may complicate data storage on the repository. Signed-off-by: marinamoore <mnm678@gmail.com>
AA-Turner
force-pushed
the
pep480-key-sharing
branch
from
a5d5caf to
159c941
Compare
|
Rebased to trigger CI. A |
|
PR was proposed by a co-author and @brainwane amongst others have approved, so merging now. A |
This pr removes references to key sharing in the automated signing section, and proposes a small modification that allows multiple maintainers to upload a package without sharing keys.