<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body><div><div style="font-family: Calibri,sans-serif; font-size: 11pt;">FWIW, I dropped a portable version into the windows-installer externals that are pulled down by the release scripts (from svn.p.o). It does require me to import my key on new machines, but since I don't use it for anything but re-signing the releases it's worth it to avoid all the intrusions.<br><br>So it's definitely possible, just a matter of finding and including the right dependencies to copy around.<br><br>Cheers,<br>Steve<br><br>Top-posted from my Windows Phone</div></div><div dir="ltr"><hr><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">From: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:p.f.moore@gmail.com">Paul Moore</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Sent: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">3/12/2017 7:36</span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">To: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:ben+python@benfinney.id.au">Ben Finney</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Cc: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:Distutils-Sig@python.org">Distutils</a></span><br><span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Subject: </span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">Re: [Distutils] GnuPG signatures on PyPI: why so few?</span><br><br></div>On 12 March 2017 at 12:13, Ben Finney <ben+python@benfinney.id.au> wrote:<br>><br>>> As a Windows user, I've "played" with it in the past, and found it<br>>> frustratingly difficult.<br>><br>> I hope many people here will find the guide published by the FSF, Email<br>> Self-Defense <URL:https://emailselfdefense.fsf.org/>, a useful walk<br>> through how to set it up properly.<br><br>That's about email, though, and as such irrelevant here. I have no<br>interest in setting up GPG for my email. Part of what I meant by<br>"intrusive" was "installs plugins for things like email and file<br>encryption that I don't want".<br><br>Part of my issue here is that people promoting signing tend to think<br>of it as a way of life, rather than as an annoying little extra step<br>that is needed for one specific activity (publishing to PyPI in the<br>context of this thread). There's essentially nothing written from the<br>POV of "you have no interest in signing, and are only doing it because<br>someone's insisting that you do - so here's how to do the least<br>possible to make them shut up". You may not agree with that attitude,<br>but it is very common in my experience, and documents that start by<br>trying to change the reader's opinion get discarded *remarkably* fast.<br><br>But this is way off-topic, so I'll refrain from saying anything more.<br><br>Paul<br>_______________________________________________<br>Distutils-SIG maillist - Distutils-SIG@python.org<br>https://mail.python.org/mailman/listinfo/distutils-sig<br></body></html>