# Removing the mention of "Microsoft" from PEP 458

**URL:** <https://discuss.python.org/t/removing-the-mention-of-microsoft-from-pep-458/2841>\
**Category:** Packaging\
**Created:** [December 11, 2019, 4:32pm UTC](https://discuss.python.org/t/removing-the-mention-of-microsoft-from-pep-458/2841 "2019-12-11T16:32:20Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![SantiagoTorres](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/santiagotorres/32/1611_2.png) [@SantiagoTorres](https://discuss.python.org/u/SantiagoTorres)\
**Post date:** [December 11, 2019, 4:32pm UTC](https://discuss.python.org/t/removing-the-mention-of-microsoft-from-pep-458/2841/1 "2019-12-11T16:32:20Z")

</div>

> [@PEP 458: Secure PyPI downloads with package signing](https://discuss.python.org/t/pep-458-secure-pypi-downloads-with-package-signing/2648/38):
>
> I’m not aware of anyone at Microsoft using TUF in production. Could you email me at steve(dot)dower(at)[microsoft.com](http://microsoft.com) with either the team or a person you know who is involved? My understanding was that TUF does not meet our compliance requirements, so I’m interested to see how they made it work.

I don’t think it’s necessary to send a secret memo. It’s not a secret that [Azure provides Notary image signing](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-content-trust), which implements the TUF spec.

Which compliance"requirements are you referring to that you think TUF doesn’t fulfill?

---

_[View the full topic](https://discuss.python.org/t/removing-the-mention-of-microsoft-from-pep-458/2841)._