On Mon, 2025-08-25 at 18:03 -0400, Eli Schwartz wrote: > It verifies nothing (0% usefulness, already fully covered by blake2 > checksums in Manifest) while *looking* like it does something else. > Again, "security theater" is inherently damaging and detrimental to > users' and developers' understanding of threat models.
Manifests only cover what the developer has fetched. If you believe that developers actively verify the source distributions they've downloaded, think again. In fact, verify-sig was added precisely because we wanted at least some minimal verification in place. Please correct me if I'm wrong. Without the change, the attack vectors include all attacks against the upstream repository + attacks against the PyPI infrastructure and CDN. With the change, we're protecting against the attacks on the latter, so even if you believe they to be unlikely, it's still a reduction of the attack surface. Isn't that a net gain? -- Best regards, Michał Górny
signature.asc
Description: This is a digitally signed message part
