Hacker News Reader

Comment by tptacek | Hacker News Reader

There are much, much better solutions for packaging!

Like signify (developed and adopted by OpenBSD) and minisign.

AFAIK Debian has been working on abandoning GPG in favor of something very similar to those two. Not sure when it's going to be shipped, though.

https://wiki.debian.org/Teams/Apt/Spec/AptSign

Which you do not describe, but set that aside: A post that honestly said "we do not like PGP, but here is our alternate plan" would be great. On an actual better solution, I don't think anyone has proposed a good one. Here is the closest I've seen from PyPi (or at least linked from this post as describing their thinking), from 10 years ago:

"Everything is Terrible So What Do We Do?

Bluntly put, I don’t know for sure. This isn’t an already solved problem nor is it an easy to solve one."

https://caremad.io/posts/2013/07/packaging-signing-not-holy-...

What I'll say on PGP is the perfect is the enemy of the good. It's not a tech anyone has much fun using, but in a group setting, used regularly, I have found it can fade into the background at least. I don't want to go any further down the "is PGP good or bad" rabbit hole than that.

But if you have a better solution for package security, please do describe it here.

It's not really up to you or me, it's up to PyPI. For my part: their logic seems pretty sound.

The current documented plans revolve around TUF (https://peps.python.org/pep-0458/, https://peps.python.org/pep-0480/). Those links have probably bit rotted a bit by now, progress has been slow on implementing them for a number of reasons (mostly OSS reasons, volunteers etc).

There's also a general consensus (not documented) that sigstore will play some kind of role here. Possibly in-toto as well?

In the 10 years since my post that you referenced, we've laid some decent plans I believe, and have just slowly been working on them, to the extent that we've been able to given our own time constraints.

And which of those are in use/available at the Python Package Index?

I don't know, but PGP isn't either, so the comparison holds.

Reply on news.ycombinator.com