[Distutils] Sooner or later, we're going to have to be more formal about how we name packages.

[Donald Stufft]

On Jun 2, 2013, at 4:21 AM, Nick Coghlan <ncoghlan at gmail.com> wrote:

> On Sun, Jun 2, 2013 at 5:37 PM, holger krekel <holger at merlinux.eu> wrote:
>> Speaking of TUF: is there some kind of PEP like doc floating already?
> 
> Just the proof-of-concept the TUF folks created about using it to
> secure /simple. I'm personally sold on the technology itself as
> something we should deploy in the long run, but I think it makes sense
> to wait until we have the static dependency metadata publication and
> various other PyPI related infrastructure issues sorted out before we
> try to offer additional protection above and beyond trusting the SSL
> CA system and PyPI itself.
> 
> That said, one of the reasons PEP 426 calls out the "essential
> dependency resolution" fields is that those are the ones I think it
> may make sense to embed in the TUF custom metadata fields.
> 
> Cheers,
> Nick.
> 
> --
> Nick Coghlan   |   ncoghlan at gmail.com   |   Brisbane, Australia
> _______________________________________________
> Distutils-SIG maillist  -  Distutils-SIG at python.org
> http://mail.python.org/mailman/listinfo/distutils-sig


If we deploy some sort of end to end signing I think TUF is a good implementation of it.

I'm not sold on the possibility of reasonably doing end to end signing here though.

-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20130602/15ee8b6e/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20130602/15ee8b6e/attachment.pgp>