Re: PyPI/pip security: waiting for input

Il giorno 11/mar/2013, alle ore 15:17, Justin Cappos <[email protected]> ha scritto:

> Yes, we're finishing this up now.   We have a working demo with TUF signing PyPI metadata and pip (integrated with TUF) correctly checking signatures, etc.   
> 
> Trishank: when do you plan to share this?   Does Kon still have some integration tests to write to show we meet the use cases from Giovanni's document?


While the code is great, I'm mainly concerned with documenting the workflow and making sure it matches the proposed requirements: how to create a key, how to revoke it, how to use an offline list of authorized keys for installation of packages, etc.

As I mentioned before, my proposal would only take me a few days to prototype (repeating this in case someone thinks that my proposal requires millions of man hours for any reason); I held it off waiting for a discussion with you.

Relink to my proposal:
https://docs.google.com/a/develer.com/document/d/1DgQdDCZY5LiTY5mvfxVVE4MTWiaqIGccK3QCUI8np4k/edit
-- 
Giovanni Bajo   ::  [email protected]
Develer S.r.l.  ::  http://www.develer.com

My Blog: http://giovanni.bajo.it

_______________________________________________
Catalog-SIG mailing list
[email protected]
http://mail.python.org/mailman/listinfo/catalog-sig