Removal of any signatures system
Removal of any signatures system
Posted Apr 12, 2018 18:52 UTC (Thu) by anarcat (subscriber, #66354)In reply to: Removal of any signatures system by dstufft
Parent article: A new package index for Python
What's interesting with (1) is that it does make the pypi x509 a trust anchor that can be used to fetch OpenPGP keys that can then be used in a TOFU manner. By removing this, that task is relegated to the keyservers which we know to have hostile material because of their open nature...
So I don't think (1) was completely pointless: more channels to verify OpenPGP keys is always a good thing... I understand you're taking the direction of TUF to fix that problem, but I figured that *removing* the feature wasn't exactly necessary in order to get there...
Of course, maybe it's the reverse and the feature was never implemented in Warehouse in which case I understand better the decision: no need implementing a feature in a "wrong" way that will be implemented in another "better" way later. :)
Thanks for the clarification!