PEP 480: Clarify automated signing solution to remove key sharing #1711
+17
−8
Conversation
This commit adds an additional step to the automated signing solution to allow multiple developers to upload keys for the same package if they are maintainers of the package. This removes the need to share keys between developers. An alternative would be to allow each project to delegate to separate developers. However, this solution would require uploading additional targets metadata which may complicate data storage on the repository. Signed-off-by: marinamoore <mnm678@gmail.com>
|
@pfmoore we should probably change the PEP delegate for this PEP. |
|
Agreed. As it's a PyPI related PEP, it should probably be @dstufft. |
|
@brainwane opened a pr to change the delegate in #1693. |
| metadata that PyPI then signs. After the initial trust is established, | ||
| developers are required to sign distributions that they upload to PyPI using | ||
| the public key's corresponding private key. The signed TUF metadata that | ||
| at least one public key's corresponding private key. The signed TUF metadata that |
pxeger
Nov 11, 2020
Contributor
reads better with the 's
reads better with the 's
| metadata that PyPI then signs. After the initial trust is established, | ||
| developers are required to sign distributions that they upload to PyPI using | ||
| the public key's corresponding private key. The signed TUF metadata that | ||
| at least one public key's corresponding private key. The signed TUF metadata that |
pxeger
Nov 11, 2020
Contributor
reads better with the 's
reads better with the 's
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
This pr removes references to key sharing in the automated signing section, and proposes a small modification that allows multiple maintainers to upload a package without sharing keys.