On Sep 21, 2013, at 8:47 PM, Vladimir Diaz <vladimir.v.diaz@gmail.com> wrote:

What about a precompiled Python extension? Bundling wheels?

The problem is when pip has a dependency on something and someone accidentally uninstalls that dependency it leaves pip in a broken state. Additionally pip uses itself to bootstrap itself so any extra dependency is something else the user has to install prior to bootstrapping pip. Dependencies can be "inlined" inside of pip to work around this issue.

Then we come to the compiled code problem. Pip currently should work on any Python interpreter and not just CPython. PyPy for instance does not support the C API very well and there's a good chance that using C code without using something like CFFI, however using something like CFFI breaks the first rule. Adding C code into the pip repository also has some other problems related to Windows installation.

Does TUF require the use of RSA? I've never found a pure Python RSA implementation that I would personally trust. It's one of the major reasons when I was planning out some ideas for a signing system my plan was to use ed25519 (http://ed25519.cr.yp.to/). It's a fast deterministic signature scheme that has a pure python implementation (~100 lines of code) written by DJB. Additionally the public keys are very small (32 bytes). Additionally there's lib sodium (which I've wrapped in PyNaCl) which implements ed25519 in high performance C code (which PyNaCl makes available in Python).