Secure submission via HTTPS isn't documented anywhere

[r1chardj0n3s]

As far as I can tell, and certainly users find the same problem, there's nothing out there to indicate that HTTPS submission of packages to PyPI is possible only using twine.

[brainwane]

We recommend Twine in the tools listing and we tell people not to use other uploading approaches because they're potentially less secure. Perhaps we should strengthen that latter explanation by explicitly saying that Twine is the only way to submit over an encrypted (HTTPS) connection.

[merwok]

Is it still true that setup.py upload does not validate certificates, now that SSL improvements have been backported to the 2.7 stdlib?

[dstufft]

Depends on your Python version and what your distro has done. Modern versions are fine, but there's the caveat where we can't tell people it's safe flat out, but that they have to think about what Python they're using to do the upload. This becomes more difficult when building wheels for like... Python 2.6 or so which cannot be safely uploaded with distutils.

So generally it's less error prone to just tell people to only use twine rather than try to document the situations in which it is safe and unsafe to use distutils.

[ncoghlan]

I'd check with @encukou and @warsaw to be sure, but I think the problematic cases now are just:

• ancient unsupported Linux distros (i.e. RHEL 5, Ubuntu 12.04, etc) that are so old even their vendors don't support them any more
• less ancient Linux distros where the system Python is nevertheless old enough to be missing the various fixes needed to validate HTTPS certs properly (e.g. RHEL 6, Ubuntu 14.04), or else the default configuration still skips validating certificates (e.g. RHEL 7.3 and earlier)
• newer Linux distros where sysadmins have explicitly opted out of defaulting to cert validation (most notably RHEL 7.4+)

All that said, I agree with @brainwane that @r1chardj0n3s's original concern has been addressed: we explicitly recommend twine, and advise against the use of distutils.

[hickford]

A secure pip publish command would solve this problem?

[ncoghlan]

The problem's already as solved as it can be: installing twine and using that instead of ./setup.py sdist bdist_wheel upload gives secure uploads regardless of version, and even the latter command uses HTTPS with checked certificates on any modern Python installation.