Re: User profile: PGP Key ID

On 21 Feb 2013 06:57, "Donald Stufft" <[email protected]> wrote:
>
> On Wednesday, February 20, 2013 at 3:50 PM, Daniel Holth wrote:
>>
>> Bikeshed detected.
>
> Basically.
>
> We basically can't use any of the properties of the various signing techs
besides
> their ability to sign documents so the choice of them doesn't
particularly matter.

Not *quite* true - GPG comes with more mature client side tech for managing
signing keys at the developer end, and that's independent of the PyPI trust
model. Since it's a coin flip otherwise, that's probably going to be enough
for us to favour GPG as the signing tech.

In the spirit of "status quo wins a stalemate", GPG should currently be
considered the default choice, with alternatives needing to offer genuinely
compelling advantages to displace it. (note that isolating the signature
generation and verification to a separate non-Python process isn't a major
issue from my point of view)

Cheers,
Nick.
>
>
> _______________________________________________
> Catalog-SIG mailing list
> [email protected]
> http://mail.python.org/mailman/listinfo/catalog-sig
>

_______________________________________________
Catalog-SIG mailing list
[email protected]
http://mail.python.org/mailman/listinfo/catalog-sig