Pre-PEP discussion: Stop providing GPG signatures for CPython artifacts

[sethmlarson (Seth Michael Larson)]

@stefanor

It was just pointed out to me that Debian hasn’t been using GPG to verify upstream tarballs

Is there a reason why GPG signatures weren’t being used by Debian in the past, despite being available?

@stefanor

As to sigstore, we’d need to support it in our uscan tool, to have automated verification happen. To include the signature in our source packages, as PGP signatures are, we’d need to modify dpkg-source, and possibly the archive, to support storing them. It’s hard to motivate that change for a single upstream. I know there are other ecosystems supporting it, but I’ve never run into any doing so actively.

Agreed that it’s tough to justify for a single upstream, however I know that in the near future there will be multiple thousands of projects with Sigstore verification materials on PyPI thanks to the work of @woodruffw on PEP 740. I know that Debian/Ubuntu package projects from PyPI and for many of these projects there aren’t any GPG signatures available, would this volume of projects and viable verification materials justify adopting Sigstore in uscan?