twine

Even twine decoupled itself from my python toolchain some time ago [1], through some dependency. Cannot install it unless you are on a system trusting trust in rust™. [1] https://github.com/pypa/twine/issues/1015

Well, I think there should be broader discussion of this inadequacy. "Implement "hook" support for package signature verification." (2013) https://github.com/pypi/warehouse/issues/1638#issuecomment-2... "GPG signing - how does that really work with PyPI?" https://github.com/pypa/twine/issues/157#issuecomment-101460... "Better integration with conda/conda-forge for building packages" https://github.com/pyodide/pyodide/issues/795#issuecomment-1... Conda now has their own package cryptographic signature software supply chain security control control. Unfortunately, conda's isn't yet W3D DIDs with Verifiable Credentials and sigstore either. Also, [CycloneDX] SBOMs don't have any package archive or package file signatures; so when you try to audit what software you have on all the containers on your infrastructure there's no way to check the

There's also PyPI package upload tool: https://github.com/pypa/twine

Twine[0] is the tool I've been using for PyPI archive management and Pipenv[1] is looking promising as the next iteration of pip. Twine makes the packaging process _slightly_ easier, although setuptools is still a bit of a pain. Pipenv handles a lot of project cruft for you: setting up a virtualenv, distinguishing dev and prod packages, locking them down and deterministic building. [0]: https://github.com/pypa/twine [1]: https://github.com/kennethreitz/pipenv

> The top result from Google: https://pypi.python.org/security I'm not sure what this has to do with anything. Yes, you may sign your uploads. Nobody verifies them on download. Since you seem to be a fan of Google, try Googling 'pip signature verification' and reading the results. Here's one place to start: https://github.com/pypa/twine/issues/157 > Really? So how do you install Babel the first time in order to shrinkwrap it? The same way you install anything else from any other ecosystem? The packages have to be up and online when you initially retrieve them, yes. I have no idea how you think that's NPM-specific. If you would like to download some code, you have to have somewhere to download it from.