Re: PEP 453 affects Debian packaging of Python packages

[Scott Kitterman <debian@kitterman.com>]

Paul Tagliamonte <paultag@debian.org> wrote:
>On Wed, Sep 18, 2013 at 05:16:22PM +1000, Ben Finney wrote:
>> Howdy all,
>> 
>> Over at the ‘python-dev’ forum, PEP 453 is being discussed. This
>affects
>> Debian packaging of Python, and packages written for Python.
>> 
>> See the discussion thread and take the opportunity to represent
>Debian
>>
><URL:https://mail.python.org/pipermail/python-dev/2013-September/128723.html>
>> while this major change to the behaviour of Python packaging is still
>> being specified.
>> 
>> Note that we don't need a dog-pile; someone with both knowledge and
>time
>> to discuss this will find that reasoned arguments work better there.
>Who
>> can do this?
>
>I butted in, since I was on python-dev anyway.
>
>http://hg.python.org/peps/rev/6c1b658bc16c
>
>is the changeset they made after I mentioned it was highly unlikely
>that
>it would be included. Basically, this means so long as
>command-not-found
>is installed, we're fine.
>
>I think this is a fine middleground and shouldn't be much if a problem.
>Donald pung me after, and he's open to working with us.

Thanks for that. I think that resolves my concern about the mandatory nature of the PEP.

I am still concerned about the security aspects of the design. It should be cryptographically verified and not installed as root. 

Scott K