# PEP 761: Deprecating PGP signatures for CPython artifacts

**URL:** <https://discuss.python.org/t/pep-761-deprecating-pgp-signatures-for-cpython-artifacts/67180>\
**Category:** PEPs\
**Created:** [October 9, 2024, 12:29pm UTC](https://discuss.python.org/t/pep-761-deprecating-pgp-signatures-for-cpython-artifacts/67180 "2024-10-09T12:29:57Z")\
**Posts on this page:** 1\
**Showing post:** 20

<div class="post-metadata">

**Author:** ![thesamesam](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/thesamesam/32/10616_2.png) [@thesamesam](https://discuss.python.org/u/thesamesam)\
**Post date:** [October 10, 2024, 11:28am UTC](https://discuss.python.org/t/pep-761-deprecating-pgp-signatures-for-cpython-artifacts/67180/20 "2024-10-10T11:28:12Z")

</div>

In Gentoo, we’re not able to start evaluating or testing sigstore until [CLI: `--offline` should mean fully offline · Issue #483 · sigstore/sigstore-python · GitHub](https://github.com/sigstore/sigstore-python/issues/483) is fixed (which it appears to be now) _and_ it lands in a release, as it can’t work offline otherwise.

I would encourage both PGP + sigstore for at least one more release cycle to allow folks to both adapt and provide feedback, with a warning on the PGP sigs on the download page at least. We didn’t have sigstore packaged at all before now and had to package a lot of new dependencies for it which took time. Others will surely be in the same position. We also have a lot of tooling around PGP and none for sigstore yet.

---

_[View the full topic](https://discuss.python.org/t/pep-761-deprecating-pgp-signatures-for-cpython-artifacts/67180)._