# Reminder: comment by Sept. 18th on cryptographic signing & malware detection choices **URL:** \ **Category:** Packaging\ **Created:** [September 12, 2019, 5:58pm UTC](https://discuss.python.org/t/reminder-comment-by-sept-18th-on-cryptographic-signing-malware-detection-choices/2324 "2019-09-12T17:58:28Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![sumanah](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sumanah/32/1722_2.png) [@sumanah](https://discuss.python.org/u/sumanah)\ **Post date:** [September 12, 2019, 5:58pm UTC](https://discuss.python.org/t/reminder-comment-by-sept-18th-on-cryptographic-signing-malware-detection-choices/2324/1 "2019-09-12T17:58:28Z")
PSF has [published a Request for Information](https://github.com/python/request-for/blob/master/2019-Q4-PyPI/RFI.md) seeking software developers to add these features to Warehouse: - Verifiable cryptographic signing of artifacts (PEP 458/TUF or similar) - Technical infrastructure and methods for automated detection of malicious package uploads We’d like for potential contractors & other experts to keep discussion at the [Q4 RFI Discourse category](https://discuss.python.org/c/python-software-foundation/pypi-q4-rfi), especially on these questions: - [What methods should we implement to detect malicious content?](https://discuss.python.org/t/what-methods-should-we-implement-to-detect-malicious-content/2240/2) - PEPs 458 and 480 offer different levels of security; which (if either) should we implement? Which one has more appropriate operational efficacy? [Should we use TUF (The Update Framework) or another approach?](https://discuss.python.org/t/which-cryptographic-signing-approach/2241) Please comment by September 18th. That’s when the RFI ends. Then, the Request for Proposals period will be September 23-October 16. Then we aim to start work in December. (Timeline details are in RFI.) (repeating from [Prerequisites & vetoes -- improving packaging security](https://discuss.python.org/t/prerequisites-vetoes-improving-packaging-security/2196/3) since someone mentioned missing it there) ---
**Author:** ![njs](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/njs/32/204_2.png) [@njs](https://discuss.python.org/u/njs)\ **Post date:** [September 13, 2019, 7:04am UTC](https://discuss.python.org/t/reminder-comment-by-sept-18th-on-cryptographic-signing-malware-detection-choices/2324/2 "2019-09-13T07:04:19Z")
---
**Author:** ![njs](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/njs/32/204_2.png) [@njs](https://discuss.python.org/u/njs)\ **Post date:** [September 13, 2019, 7:04am UTC](https://discuss.python.org/t/reminder-comment-by-sept-18th-on-cryptographic-signing-malware-detection-choices/2324/3 "2019-09-13T07:04:53Z")
[locking this thread at Sumana’s request, to keep discussion in the linked threads instead of here]