# Pre-PEP discussion: Stop providing GPG signatures for CPython artifacts

**URL:** <https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058>\
**Category:** Ideas\
**Created:** [September 25, 2024, 6:42pm UTC](https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058 "2024-09-25T18:42:19Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![sethmlarson](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sethmlarson/32/1644_2.png) [@sethmlarson](https://discuss.python.org/u/sethmlarson)\
**Post date:** [September 26, 2024, 12:40pm UTC](https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058/8 "2024-09-26T12:40:10Z")

</div>

Thanks @mgorny @hroncok and @mcepl for providing feedback, this is great information to have so we can prioritize.

For having a compiled binary for Sigstore, I was pointed to the [sigstore-go client](https://github.com/sigstore/sigstore-go/) as an option. In fact, the sigstore-go client already lists offline verification on their list of features. I’ll double-check that that is correct, though!

---

_[View the full topic](https://discuss.python.org/t/pre-pep-discussion-stop-providing-gpg-signatures-for-cpython-artifacts/65058)._