There are author-email and maintainer-email fields.

With a mailing list, package maintainers can share responsibility (*) and hand off correspondence without forwards and indentation.

Google Groups is free; are there alternatives:

You can use a third party service to create e.g. GitHub or GitLab issues via email; however, security sensitive information (vulnerabilities, credentials, personal information) may require additional caution and admonitions.

If not otherwise specified in the long description, presumably the author-email and/or maintainer-email address(es) are the correct place to send fair disclosure information.

This could be a separate thread/issue and an additional package metadata field maybe for Package Metadata 1.3? Sorry, a BIT OT.

security-email?

On Thursday, December 7, 2017, Barry Warsaw <barry@python.org> wrote:

I think I implicitly knew this, but as I've just released a package (to
be announced soon) that actually has multiple authors, I found out first
hand that PyPI rejects uploads where the author-email field isn't a
completely valid email address, and that there is no support for
multiple author emails.

As it turns out, you can kludge this into your pyproject.toml or
setup.py file.  flit for example separates multiple emails with a
newline, but you could also separate them with commas.  You don't notice
the problem until PyPI rejects the upload (with a 400 IIRC).

I filed this issue with flit: https://github.com/takluyver/flit/issues/153

It looks like Thomas agrees that at least flit will eventually validate
its fields so you error early.  It was a bit of a PITA to do my upload
because I didn't notice the problem until after I'd tagged the repo.

Multiple package authors doesn't seem like that fringe of a use case;
are there any plans, documents, PEPs, musings, grumbles about supporting
multiple package authors explicitly?

Cheers,
-Barry

_______________________________________________
Distutils-SIG maillist  -  Distutils-SIG@python.org
https://mail.python.org/mailman/listinfo/distutils-sig