# PEP 458: Secure PyPI downloads with package signing **URL:** \ **Category:** PEPs\ **Created:** [November 12, 2019, 11:36pm UTC](https://discuss.python.org/t/pep-458-secure-pypi-downloads-with-package-signing/2648 "2019-11-12T23:36:53Z")\ **Posts on this page:** 1\ **Showing post:** 11
**Author:** ![sumanah](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sumanah/32/1722_2.png) [@sumanah](https://discuss.python.org/u/sumanah)\ **Post date:** [December 4, 2019, 2:37am UTC](https://discuss.python.org/t/pep-458-secure-pypi-downloads-with-package-signing/2648/11 "2019-12-04T02:37:29Z")
There have been some miscommunications here but no one has meant to bypass the community. As I see it, the TUF team conversed with Python packaging leadership quite a lot, but not all in one place (such as Discourse), and often in conversational spaces that have far fewer core devs. I think this is what happened: The TUF team conversed with the distutils-sig list at some length when originally developing the PEP in 2013-2015, e.g., - [Testing pip security without and with TUF](https://mail.python.org/archives/list/distutils-sig@python.org/thread/WD2355DJHUYCLKQ6NBWLAREKKXMNCSWN/#WD2355DJHUYCLKQ6NBWLAREKKXMNCSWN) - [Status report on PyPI+pip+TUF](https://mail.python.org/archives/list/distutils-sig@python.org/thread/MIEK7BHCVVUR64UQEHWZPQ75LG5EHYDP/#MIEK7BHCVVUR64UQEHWZPQ75LG5EHYDP) - [Surviving a Compromise of PyPI - PEP 458 and 480](https://mail.python.org/archives/list/distutils-sig@python.org/thread/TXM2O34TMSHH5U6WA2IF7XKO5J3G5NQQ/#3QLN4KECII6KULKYXS7U4CVBEPGK4B6S) and continued replying on the list when people raised questions, e.g., [TUF, Warehouse, Pip, PyPA, ld-signatures, ed25519](https://mail.python.org/archives/list/distutils-sig@python.org/thread/CKBDVDW6GMR2HB25WRRH5Q3KFDJZOT7A/#QEBTQYBHNCGS2BJLUPY6UDPMVADY4R4T) in 2018, or proactively, e.g., [Summary of PyPI overhaul in new LWN article](https://mail.python.org/archives/list/distutils-sig@python.org/thread/GTSHF6EGLQDC4CJOPNPKPVTRJYOHFHUD/#AYYCI7SBILOJPTUE2PPGJ2DXOKZGUEQE). The PEP remained in Draft status till March of this year, when Brett consulted with Donald and [updated its status to Deferred](https://github.com/python/peps/pull/931). In 2018 [Facebook gave us a gift](https://pyfound.blogspot.com/2018/12/upcoming-pypi-improvements-for-2019.html) (it’s $100,000 USD) to be used for PyPI security work, specifically on cryptographic signing and malware detection. (Sorry for the confusion here – the $400K you’re thinking of is the funding we just got this year for [pip dependency resolver work](https://wiki.python.org/psf/Pip2020DonorFundedRoadmap).) Now that we had funding, it seemed more likely PEP 458 could be implemented, so there was more discussion – for instance, at PyCon NA this year, several TUF folks had a long conversation with several packaging leaders to talk about feasibility and implementation. Then, later this year, I publicized the Request For Interest (which included seeking comment on PEP 458), and did not ever mean to handle it out of the sight of core devs and community. I [publicized it here](https://discuss.python.org/t/reminder-comment-by-sept-18th-on-cryptographic-signing-malware-detection-choices/2324) and on distutils-sig, and had one month earlier [publicized to Discourse that the RFI was coming](https://discuss.python.org/t/current-upcoming-funding-for-pypi-packaging-security-roundup-fyi/2195). In most of these cases, in retrospect, I did not use the phrase “PEP 458” in my subject line; I probably should have done so more often. The TUF folks asked me for advice on [getting further with the PEP](https://github.com/pypa/warehouse/issues/5247) and I got confused and said (a month ago): “Current status: python/peps#1203 is awaiting review from @dstufft to revise PEP 458. After that, there needs to be a discussion on [Discourse] to get the PEP from ‘Draft’ to ‘Accepted’.” A few packaging maintainers had shared critique in the pull request and the PEP authors were responding to it. I should have said that the Discourse discussion needed to start right away and not wait for the PR review. I’m sorry about that. When we were waiting for a review from Donald, I suggested that Trishank post his nudge publicly rather than needlessly do so privately – Donald’s reply came in the form of a review on the PR that Trishank had already posted. I’m sorry that my suggestion went badly and made you feel left out, Guido. I don’t mean here to take on the mantle of BDFL-Delegate from Donald, or the role of TUF implementation manager from Ernest, but since my (in some cases suboptimal) advice and publicity work is part of the reason for the current situation, I figured I should share my assessment. --- _[View the full topic](https://discuss.python.org/t/pep-458-secure-pypi-downloads-with-package-signing/2648)._