# Discouraging/deprecating PEP 427-style signatures?

**URL:** <https://discuss.python.org/t/discouraging-deprecating-pep-427-style-signatures/94968>\
**Category:** Packaging\
**Created:** [June 9, 2025, 6:32pm UTC](https://discuss.python.org/t/discouraging-deprecating-pep-427-style-signatures/94968 "2025-06-09T18:32:50Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![konstin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/konstin/32/20207_2.png) [@konstin](https://discuss.python.org/u/konstin)\
**Post date:** [December 2, 2025, 1:23pm UTC](https://discuss.python.org/t/discouraging-deprecating-pep-427-style-signatures/94968/4 "2025-12-02T13:23:08Z")

</div>

Given that there were no further comments, I’d like to move this proposal ahead. Specifically, I’d like to propose:

- Deprecate the PEP 427-style signatures `RECORD.jws` or `RECORD.p7s`
- Update [Binary distribution format - Python Packaging User Guide](https://packaging.python.org/en/latest/specifications/binary-distribution-format/#the-dist-info-directory) to say “`RECORD.jws` and `RECORD.p7s` are deprecated files that were used for digital signatures. They are not mentioned in RECORD.”
- Remove the “Signed wheel files” section at [Binary distribution format - Python Packaging User Guide](https://packaging.python.org/en/latest/specifications/binary-distribution-format/#signed-wheel-files)

Motivations:

- `RECORD.jws` and `RECORD.p7s` haven’t found mainstream usage, and aren’t check by any major tool I’m aware of. They are not supported in pip nor uv.
- These signatures are presented as security features in the spec, when they in fact don’t provide any security (they aren’t checked).
- The newer, supported security features, specifically hash checking for archives and attestations, use external hashes and signatures, which are presented in the index, instead of internal signatures.
- Since these features build on top of `RECORD` checking (which pip and uv don’t do), this is a first step before being able to discuss further `RECORD` changes that align spec and tool implementations.

@pf_moore I don’t know what the process here is, for a PUG spec change that is not a clarification but smaller than a real PEP, is there any process description i missed? I checked with PEP 1 but it does not seem applicable, and I couldn’t find anything on PUG itself. Unless there’s more opinions on this more concrete proposal, should we do something like a two-week final comment period with the above proposal?

---

_[View the full topic](https://discuss.python.org/t/discouraging-deprecating-pep-427-style-signatures/94968)._