PEP 458: Secure PyPI downloads with package signing

[sumanah (Sumana Harihareswara)]

I noticed that, over the course of the last several weeks, there’s been some back-and-forth about whether the PEP should include either or both of:

1. a short review of how other package managers/ecosystems handle this threat
2. a short list of other platforms/services that have integrated TUF successfully, and what benefits TUF has provided to them

@pf_moore

Some other things that are typically covered in a PEP but which are missing here:

• Review of how other ecosystems handle this issue. This data integrity issue isn’t unique to Python. How do other languages (rust, javascript, ruby) and distributions (Red Hat, Ubuntu, Homebrew, Microsoft (nuget)) handle it?

@SantiagoTorres

I think there’s quite some literature review around it, as well as other successful implementations in other ecosystems.

@pf_moore

Something as simple as “TUF has been used successfully in X, Y and Z, and has provided the following benefits there” would be plenty. None of this should be a huge burden, it’s just a matter of remembering when writing the background in the PEP that things which are “obvious” to the authors are not obvious to the reader.

@tiran

Please drop the list of companies from the text and rather mention a list of technologies or products that are based on TUF spec…I care more about technologies than fancy companies names.

In response to @tiran and to the conversation about mentioning Microsoft, @mnm678 updated the abstract to only mention “TUF has been used in production by a number of organizations, including use in Cloud Native Computing Foundation’s Notary service, which provides the infrastructure for container image signing in Docker Registry”.

Is this sufficient? Would people prefer more detail on adoptions? I think the current PEP draft does not include a short review of how other package managers/ecosystems handle this threat, or a link to such a review; is this something people would find helpful?