GPG signatures for source validation about aiohttp-cors HOT 7 CLOSED

I read some very interesting article month ago about the exact same issue for node modules. This was an imaginary story about what could happen:
https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5

Ironically it happened:
https://www.bleepingcomputer.com/news/security/compromised-javascript-package-caught-stealing-npm-credentials/

Okay, let me clarify:

Warehouse/pip developers refuse to add gpg signatures to their packaging system. That is really not a good idea, as stated in the comments of the issue you linked.

I am asking, because I am packaging your software for an ArchLinux system. It definitely would give us additional security across multiple releases. If you sign your releases, we would notice if compromised packages will be uploaded to the existing or new release.

We do not want to blindly download packages from github/pypi or via pip. It is sad enough that they dont provide security features, so the only way to secure packages is to do it via your operating system of trust.

So please take this issue serious and rethink your decision.

from aiohttp-cors.

No, I need to convince you. Because the distribution packages do not use pypi, they use your sources published on github. And those can be verified, if gpg signatures are provided and it would help us a lot.

I'd love to bring homeassistant to the official archlinux repository, but my personal requirement for this is to have all dependencies gpg signed - for the security of all users and my responsiblity. And your package is one of those dependencies.

from aiohttp-cors.

Sorry, the answer is no.
GPG signing requires changing our autodeployment process, I don't want to touch it.
Say again, if PyPI is not secure enough to your requirements -- please convince its maintainers to raise up the protection level.
I don't want to do an extra work unless it the work is required.

from aiohttp-cors.

I understand that you want to avoid additional work.

Uploading an additioal, signed tarfile should be not much of work though and integrate with your current workflow. Even gpgit can handle existing git tags and upload signed archived automated to github. It cant get easier than that.

from aiohttp-cors.

No.
The official PyPI position is: we don't need this feature.
See https://caremad.io/posts/2013/07/packaging-signing-not-holy-grail/ and pypi/warehouse#3356 (as very many articles/issues about GPG signing on PyPI).

from aiohttp-cors.

Any updates on this?

from aiohttp-cors.

You need to convince not me but PyPI team

from aiohttp-cors.