Hi, I would appreciate packaging review of:
https://salsa.debian.org/python-team/packages/python-sigstore-protobuf-specs Some questions/concerns: - Same concern about using PyPI tarballs as for the other packages, some files are missing compared to upstream's GitHub repository. Maybe this is actually common for Python packages, and understanding this is part of my learning curve. But it still feels surprising to me, and a bit sub-optimal from a supply-chain safety point of view: which hosting site to rely on? PyPI that publish tarballs, or GitHub who (should) hold the source code used to generate the tarballs? How to detect when these differ? What to do about it? /Simon Simon Josefsson <si...@josefsson.org> writes: > Package: wnpp > Severity: wishlist > Owner: Simon Josefsson <si...@josefsson.org> > X-Debbugs-Cc: debian-de...@lists.debian.org, debian-python@lists.debian.org > > * Package name : python-sigstore-protobuf-specs > Version : 0.3.3 > Upstream Author : The Sigstore Authors > * URL : https://github.com/sigstore/protobuf-specs > * License : Apache-2 > Programming Lang: Python > Description : Python bindings for Sigstore's protocol buffer (protobuf) > specs > > These are the Python language bindings for Sigstore's protobuf specs. > > I plan to maintain this package as part of the Python team: > > https://salsa.debian.org/python-team/packages/python-sigstore-protobuf-specs > > Work in progress will hopefully be found here: > > https://salsa.debian.org/jas/sigstore-protobuf-specs > https://salsa.debian.org/jas/protobuf-specs > > /Simon >
signature.asc
Description: PGP signature
