From f7812e746262f9ba6f92bce195cadae6934fd7f6 Mon Sep 17 00:00:00 2001 From: marinamoore Date: Wed, 22 Jan 2020 13:06:47 -0500 Subject: [PATCH 1/2] Add non-goals section to clarify that this PEP does not remove support for GPG signatures. --- pep-0458.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pep-0458.txt b/pep-0458.txt index 8da3ebae987..5c38893f046 100644 --- a/pep-0458.txt +++ b/pep-0458.txt @@ -108,6 +108,13 @@ of end-to-end signing. __ https://github.com/theupdateframework/tuf/tree/v0.11.1/tuf/client#updaterpy +Non-goals +========= + +This PEP does not eliminate any existing features from PyPI. In particular, it +does not replace existing support for GPG signatures. + + PEP Status ========== From 322b4ed54f27495bd20b88ff8df9f860def87be1 Mon Sep 17 00:00:00 2001 From: mnm678 Date: Wed, 22 Jan 2020 15:32:31 -0500 Subject: [PATCH 2/2] Update pep-0458.txt Co-Authored-By: Trishank Karthik Kuppusamy <33133073+trishankatdatadog@users.noreply.github.com> --- pep-0458.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pep-0458.txt b/pep-0458.txt index 5c38893f046..f87a2886c51 100644 --- a/pep-0458.txt +++ b/pep-0458.txt @@ -112,7 +112,9 @@ Non-goals ========= This PEP does not eliminate any existing features from PyPI. In particular, it -does not replace existing support for GPG signatures. +does not replace existing support for GPG signatures. Developers can continue +to upload detached GPG signatures along with distributions. In the future, +PEP 480 may allow developers to directly sign TUF metadata using their GPG keys. PEP Status