On 9/2/25 5:07 AM, Michał Górny wrote: > Hi, > > Here's another shot at provenance verification API. To address your > concerns, I've renamed the flag from verify-sig to verify-provenance. > This should make the difference in semantics and security model clearer.
I really do not believe it helps at all to make it "clearer" that adding the USE flag is harmful -- we should simply not add it at all. And certainly I would rather it never be added to any packages I comaintain. The USE flag description doesn't even make it clear that it doesn't verify the code is the same as the upstream repository (e.g. due to actions/cache poisoning it is not even possible to discover after the fact that downloaded release dependencies were malicious). If you want to verify this information a better mechanism would be to, well, actually verify it. Download the github repository snapshot, attempt to build an sdist, verify the bytes of all files in the sdist are the same as the PyPI sdist. That would be something I'd find actually interesting and useful and would love to personally use. -- Eli Schwartz
OpenPGP_signature.asc
Description: OpenPGP digital signature
