Signed releases for downstreams about geopy HOT 3 CLOSED

FWIW, I will switch to signed git tags for the time being. Do note, that for some downstreams this may not be an option.

from geopy.

Hi! Thank you for letting me know about this change! It's indeed a concerning move on PyPi's part.

Do you plan on providing signatures for tarballs on github going forward?

Sure, I'm open to it. I will include this in the release process for the next release.

If so, doing a release would unblock me on that topic.
FWIW, I will switch to signed git tags for the time being. Do note, that for some downstreams this may not be an option.

I hadn't planned on doing a new release anytime soon, but from what I understood, this is no longer blocking you since the signed git tags worked for you.

from geopy.

https://github.com/geopy/geopy/releases/tag/2.4.0 has just been released with a signature attached to the GitHub release. This step is now also incorporated into the release checklist: 4fd273a

from geopy.