# Pre-PEP discussion: Stop providing GPG signatures for CPython artifacts

**URL:** https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058
**Category:** Ideas
**Created:** [September 25, 2024, 6:42pm UTC](https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058 "2024-09-25T18:42:19Z")
**Posts on this page:** 1
**Showing post:** 18

<div class="post-metadata">

### Author: ![stefanor](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/stefanor/32/9984_2.png) [@stefanor](https://discuss.python.org/u/stefanor)
#### Post date: [October 2, 2024, 12:39pm UTC](https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058/18 "2024-10-02T12:39:20Z")

</div>

It was just pointed out to me that Debian hasn’t been using GPG to verify upstream tarballs, and I am about to fix that.

As to sigstore, we’d need to support it in our [uscan](https://manpages.debian.org/bookworm/devscripts/uscan.1.en.html) tool, to have automated verification happen. To include the signature in our source packages, as PGP signatures are, we’d need to modify `dpkg-source`, and possibly the archive, to support storing them. It’s hard to motivate that change for a single upstream. I know there are other ecosystems supporting it, but I’ve never run into any doing so actively.

So… we can use GPG and really should. I’ll do that. If it were dropped, we’d rely on local manual verification (probably forgotten), rather than being able to migrate completely to sigstore.

---

_[View the full topic](https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058)._