| Store | Cart

Re: [Python-Dev] Status of packaging in 3.3

From: Paul Moore <p.f....@gmail.com>
Fri, 22 Jun 2012 14:48:58 +0100
On 22 June 2012 13:09, Vinay Sajip <vina...@yahoo.co.uk> wrote:
> Paul Moore <p.f.moore <at> gmail.com> writes:>>> Signed binaries may be a solution. My experience with signed binaries>> has not been exactly positive, but it's an option. Presumably PyPI>> would be the trusted authority? Would PyPI and the downloaders need to>> use SSL? Would developers need to have signing keys to use PyPI? And>> more to the point, do the people designing the packaging solutions>> have experience with this sort of stuff (I sure don't )?>> I'm curious - what problems have you had with signed binaries?

As a user, I guess not that much. I may be misremembering bad
experiences with different things. We've had annoyances with
self-signed jars, and websites. It's generally more about annoying
"can't confirm this should be trusted, please verify" messages which
people end up just saying "yes" to (and so ruining any value from the
check).

But I don't know how often I have used them, to the extent that the
only time I'm aware of them is when they don't work silently (e.g., I
get a prompt asking if I want to trust this publisher - this is
essentially a failure, as I always say "yes" simply because I have no
idea how I would go about deciding that I do trust them, beyond what
I've already done in locating and downloading the software from them!)

> I dipped my toes> in this particular pool with the Python launcher installers - I got a code> signing certificate and signed my MSIs with it. The process was fairly painless.

OK, that's a good example, I didn't even realise those installers were
signed, making it an excellent example of how easy it can be when it
works.

But you say "I got a code signing certificate". How? When I dabbled
with signing, the only option I could find that didn't involve paying
and/or having a registered domain of my own was a self-signed
certificate, which from a UI point of view seems of little use "Paul
Moore says you should trust him. Do you? Yes/No"...

If signed binaries is the way we go, then we should be aware that we
exclude people who don't have certificates from uploading to PyPI.
Maybe that's OK, but without some sort of check I don't know how many
current developers that would exclude, let alone how many potential
developers would be put off.

A Python-supported build farm, which signed code on behalf of
developers, might alleviate this. But then we need to protect against
malicious code being submitted to the build farm, etc.

> As far as I know, all signing does is to indicate that the binary package hasn't> been tampered with and allows the downloader to decide whether they trust the> signer not to have allowed backdoors, etc. I don't see that it mandates use of> SSL, or even signing, by anyone. At least some people will require that an> installer be invokable with an option that causes it to bail if any part of> what's being installed can't be verified (for some value of "verified").

Fair enough. I don't object to offering the option to verify
signatures (I think I said something like that in an earlier message).
I do have concerns about making signed code mandatory. (Not least over
whether it'd let me install my own unsigned code!)

Paul
_______________________________________________
Python-Dev mailing list
Pyth...@python.org
http://mail.python.org/mailman/listinfo/python-dev
Unsubscribe: http://mail.python.org/mailman/options/python-dev/python-dev-ml%40activestate.com

Recent Messages in this Thread
Éric Araujo Jun 19, 2012 09:46 pm
mar...@v.loewis.de Jun 22, 2012 03:24 pm
Vinay Sajip Jun 22, 2012 03:48 pm
Vinay Sajip Jun 23, 2012 02:14 pm
Stephen J. Turnbull Jun 23, 2012 08:02 am
Donald Stufft Jun 22, 2012 04:56 pm
Paul Moore Jun 22, 2012 01:24 pm
Tarek Ziadé Jun 22, 2012 06:42 am
Nick Coghlan Jun 22, 2012 07:11 am
Donald Stufft Jun 22, 2012 12:01 am
Hynek Schlawack Jun 28, 2012 11:09 am
Ethan Furman Jun 19, 2012 10:09 pm
Nick Coghlan Jun 19, 2012 10:14 pm
Guido van Rossum Jun 20, 2012 04:36 am
Antoine Pitrou Jun 20, 2012 09:27 am
Hynek Schlawack Jun 20, 2012 11:20 am
Antoine Pitrou Jun 20, 2012 11:29 am
Éric Araujo Jun 20, 2012 03:34 pm
Georg Brandl Jun 20, 2012 03:44 pm
Tarek Ziadé Jun 20, 2012 04:24 pm
Paul Moore Jun 19, 2012 10:54 pm
Chris McDonough Jun 19, 2012 11:34 pm
Antoine Pitrou Jun 20, 2012 01:23 am
Nick Coghlan Jun 20, 2012 05:00 am
Antoine Pitrou Jun 20, 2012 09:04 am
Tarek Ziadé Jun 20, 2012 09:18 am
Victor Stinner Jun 20, 2012 06:36 am
Donald Stufft Jun 20, 2012 07:36 am
Georg Brandl Jun 20, 2012 07:09 am
Dirkjan Ochtman Jun 20, 2012 07:32 am
"Martin v. Löwis" Jun 20, 2012 08:18 am
Tarek Ziadé Jun 20, 2012 08:55 am
Dirkjan Ochtman Jun 20, 2012 09:05 am
Antoine Pitrou Jun 20, 2012 09:12 am
Tarek Ziadé Jun 20, 2012 09:22 am
Antoine Pitrou Jun 20, 2012 09:49 am
Tarek Ziadé Jun 20, 2012 10:30 am
Antoine Pitrou Jun 20, 2012 10:39 am
Tarek Ziadé Jun 20, 2012 10:54 am
Georg Brandl Jun 20, 2012 11:06 am
Vinay Sajip Jun 20, 2012 09:51 am
Antoine Pitrou Jun 20, 2012 09:54 am
Tarek Ziadé Jun 20, 2012 10:34 am
Paul Moore Jun 20, 2012 11:19 am
Tarek Ziadé Jun 20, 2012 11:31 am
Nick Coghlan Jun 20, 2012 12:53 pm
Paul Moore Jun 20, 2012 01:10 pm
Alexis Métaireau Jun 20, 2012 01:19 pm
Nick Coghlan Jun 20, 2012 01:28 pm
Alexis Métaireau Jun 20, 2012 01:36 pm
Tarek Ziadé Jun 21, 2012 12:00 pm
Alexis Métaireau Jun 20, 2012 01:16 pm
Paul Moore Jun 20, 2012 01:47 pm
Paul Moore Jun 20, 2012 11:11 am
Antoine Pitrou Jun 20, 2012 11:46 am
Nick Coghlan Jun 20, 2012 01:02 pm
Bill Janssen Jun 20, 2012 02:46 pm
PJ Eby Jun 20, 2012 05:29 pm
Nick Coghlan Jun 21, 2012 03:57 am
Chris McDonough Jun 21, 2012 04:44 am
Nick Coghlan Jun 21, 2012 08:45 am
David Cournapeau Jun 21, 2012 09:28 am
Nick Coghlan Jun 21, 2012 11:58 am
David Cournapeau Jun 21, 2012 12:19 pm
Nick Coghlan Jun 21, 2012 12:31 pm
Chris McDonough Jun 21, 2012 11:48 am
Oscar Benjamin Jun 21, 2012 12:07 pm
Nick Coghlan Jun 21, 2012 12:21 pm
Chris McDonough Jun 21, 2012 12:51 pm
Nick Coghlan Jun 21, 2012 01:29 pm
Chris McDonough Jun 21, 2012 02:12 pm
Nick Coghlan Jun 21, 2012 02:30 pm
Chris McDonough Jun 21, 2012 02:59 pm
Nick Coghlan Jun 21, 2012 03:48 pm
Jesse Noller Jun 22, 2012 04:12 pm
PJ Eby Jun 21, 2012 03:45 pm
Chris McDonough Jun 21, 2012 04:02 pm
Chris Lambacher Jun 21, 2012 03:17 pm
Barry Warsaw Jun 21, 2012 02:08 pm
Vinay Sajip Jun 21, 2012 01:45 pm
Barry Warsaw Jun 21, 2012 01:57 pm
Nick Coghlan Jun 21, 2012 02:09 pm
Dag Sverre Seljebotn Jun 21, 2012 09:08 am
Tarek Ziadé Jun 21, 2012 11:56 am
Dag Sverre Seljebotn Jun 21, 2012 12:45 pm
Tarek Ziadé Jun 21, 2012 01:23 pm
Dag Sverre Seljebotn Jun 21, 2012 02:26 pm
Tarek Ziadé Jun 21, 2012 07:05 pm
Dag Sverre Seljebotn Jun 21, 2012 08:46 pm
Tarek Ziadé Jun 21, 2012 09:04 pm
David Cournapeau Jun 21, 2012 09:55 pm
Tarek Ziadé Jun 21, 2012 10:42 pm
Dag Sverre Seljebotn Jun 21, 2012 10:05 pm
Dag Sverre Seljebotn Jun 21, 2012 10:25 pm
Antoine Pitrou Jun 21, 2012 10:00 pm
David Cournapeau Jun 21, 2012 10:32 pm
Alex Clark Jun 21, 2012 01:56 pm
PJ Eby Jun 21, 2012 01:31 pm
Nick Coghlan Jun 21, 2012 02:03 pm
Zooko Wilcox-OHearn Jun 21, 2012 03:02 pm
Antoine Pitrou Jun 21, 2012 03:10 pm
PJ Eby Jun 21, 2012 03:37 pm
Chris McDonough Jun 21, 2012 03:50 pm
Tarek Ziadé Jun 21, 2012 04:03 pm
PJ Eby Jun 21, 2012 04:26 pm
Chris McDonough Jun 21, 2012 04:44 pm
Tarek Ziadé Jun 21, 2012 05:20 pm
Alex Clark Jun 21, 2012 05:43 pm
PJ Eby Jun 21, 2012 05:49 pm
Tarek Ziadé Jun 21, 2012 06:49 pm
Chris McDonough Jun 21, 2012 05:56 pm
Tarek Ziadé Jun 21, 2012 07:17 pm
Paul Moore Jun 21, 2012 08:01 pm
PJ Eby Jun 21, 2012 08:34 pm
Donald Stufft Jun 21, 2012 09:38 pm
Alex Clark Jun 21, 2012 11:34 pm
Stephen J. Turnbull Jun 22, 2012 06:25 am
Nick Coghlan Jun 22, 2012 06:30 am
Tarek Ziadé Jun 20, 2012 09:17 am
Antoine Pitrou Jun 22, 2012 08:40 pm
Paul Moore Jun 22, 2012 01:48 pm
Vinay Sajip Jun 22, 2012 03:36 pm
David Cournapeau Jun 22, 2012 01:47 pm
Vinay Sajip Jun 22, 2012 12:09 pm
Dag Sverre Seljebotn Jun 23, 2012 01:37 pm
Antoine Pitrou Jun 23, 2012 01:28 pm
Barry Warsaw Jun 22, 2012 12:14 pm
Antoine Pitrou Jun 22, 2012 02:19 pm
Antoine Pitrou Jun 23, 2012 02:24 pm
Tim Golden Jun 22, 2012 12:23 pm
Stephen J. Turnbull Jun 22, 2012 12:39 pm
Nick Coghlan Jun 23, 2012 11:57 am
mar...@v.loewis.de Jun 28, 2012 11:56 am
David Cournapeau Jun 23, 2012 11:53 am
Lennart Regebro Jun 23, 2012 11:55 am
Alexandre Zani Jun 22, 2012 05:09 pm
Floris Bruynooghe Jun 23, 2012 10:52 am
Donald Stufft Jun 22, 2012 10:38 am
Antoine Pitrou Jun 23, 2012 12:35 pm
Vinay Sajip Jun 23, 2012 01:14 pm
Dag Sverre Seljebotn Jun 23, 2012 12:48 pm
Vinay Sajip Jun 23, 2012 01:20 pm
Terry Reedy Jun 22, 2012 08:55 pm
Donald Stufft Jun 22, 2012 09:06 pm
Dag Sverre Seljebotn Jun 22, 2012 10:28 am
Paul Moore Jun 22, 2012 11:27 am
Antoine Pitrou Jun 22, 2012 09:55 am
Alex Clark Jun 22, 2012 01:13 pm
Vinay Sajip Jun 22, 2012 09:11 am
Nick Coghlan Jun 22, 2012 06:29 am
Nick Coghlan Jun 22, 2012 05:05 am
Dag Sverre Seljebotn Jun 23, 2012 11:13 am
Vinay Sajip Jun 23, 2012 12:27 pm
Barry Warsaw Jun 22, 2012 12:20 pm
Dag Sverre Seljebotn Jun 22, 2012 09:52 am
Vinay Sajip Jun 22, 2012 10:09 am
Donald Stufft Jun 22, 2012 10:35 am
Vinay Sajip Jun 22, 2012 07:56 am
Donald Stufft Jun 22, 2012 09:38 am
PJ Eby Jun 22, 2012 08:11 pm
David Cournapeau Jun 22, 2012 08:35 pm
David Cournapeau Jun 22, 2012 10:20 am
Donald Stufft Jun 22, 2012 08:05 am
Dag Sverre Seljebotn Jun 22, 2012 09:22 am
Messages in this thread