@steve.dower I’m not sure whether your concern has been addressed elsewhere? (I haven’t been keeping up to that extent; apologies!) I think TUF and PEP 458 concerns should now go in PEP 458: Surviving a Compromise of PyPI – heads-up @dstufft and @trishankatdatadog to reply, preferably in that thread.
2 Likes