Re: GnuPG signatures on PyPI: why so few?

[Ben Finney <bignose@debian.org>]

Brian May <bam@debian.org> writes:

> Maybe there is some way of turning signatures on by default, so I don't
> have to remember for every upload, if so, I haven't been able to work it
> out yet however.

I don't know how it should be done using the currently-recommended
Twine tool.


For Distutils, the ‘upload’ command has a ‘--sign’ option
<URL:https://docs.python.org/3.1/distutils/uploading.html> to specify
the distribution should be GnuPG signed, and the ‘--identity’ option
specifies which GnuPG identity from your keyring should sign the
distribution.

To set an option default for Setuptools commands, you put it in the
‘setup.cfg’ file.

So, in the code base's ‘setup.cfg’:

    [upload]

    # Sign distributions, and upload the signing public key?
    sign = true

    # Which GnuPG identity to use for signing?
    identity = christina@example.org

-- 
 \      “Probably the earliest flyswatters were nothing more than some |
  `\    sort of striking surface attached to the end of a long stick.” |
_o__)                                                     —Jack Handey |
Ben Finney