PGP signatures on PyPI: worse than useless
PGP is an unfortunate obsolete technology, which sadly failed to evolve with the times.<p>I think the main thing that crippled PGP is tooling. What we have available is GnuPG, and GnuPG is horrible for every use case but what it was made for: A command-line interactive application, made for a single person&#x27;s personal usage.<p>GnuPG insists on a model where it manages everything: key parsing, a key database, and the entire signing&#x2F;verification process. There&#x27;s no proper libgnupg either, what gpgme does is calling gpg, and presenting a library interface.<p>The problem with this is that GnuPG is very unfriendly towards attempts to build something new from the pieces. It really wants to be a commandline application that deals with a single person&#x27;s encryption&#x2F;decryption activities. So if you want to say, run statistics on PGP keys, or write a keyserver, or use it to implement signatures for packages, either you do it the GnuPG way, or you very laboriously trick it into doing what you need, or you write your own crypto code.<p>Option 1 isn&#x27;t great if you want anything weird like statistics gathering.<p>Option 2 is just awkward and messy. Both 1 and 2 quickly run into limits. GPG for instance doesn&#x27;t like trying to work with a database of a million keys. It has heavy startup costs. It&#x27;s made for humans, not for any kind of heavy lifting.<p>Option 3 sucks because OpenPGP is extremely complex, and writing crypto code is very ill advised for most people.<p>And I think that&#x27;s kinda what crippled the ecosystem. Doing anything but what gnupg wants to do has extreme startup costs, so few people ever try, and most people do it badly.<p>Doing what the author did here involves really going out of your way -- in a better world we&#x27;d have simple to use tooling to do this work, and PyPI would just do validation and reject bad stuff, but doing so is extremely non-trivial in PGP.<p>*Edit:* Case in point, I wondered how the author did this analysis. They made a tool for it, in April 2023: <a href="https:&#x2F;&#x2F;blog.yossarian.net&#x2F;2023&#x2F;04&#x2F;14&#x2F;Introducing-pgpkeydump" rel="nofollow">https:&#x2F;&#x2F;blog.yossarian.net&#x2F;2023&#x2F;04&#x2F;14&#x2F;Introducing-pgpkeydump</a><p>This is a tool that GPG should have had decades ago, and yet it didn&#x27;t exist until now, when pretty much everyone has given up on PGP signing.<p><i>Edit 2:</i> A nice blog post on how painful it is to deal with gpg if you want to actually build on top of it: <a href="https:&#x2F;&#x2F;www.mailpile.is&#x2F;blog&#x2F;2014-10-07_Some_Thoughts_on_GnuPG.html" rel="nofollow">https:&#x2F;&#x2F;www.mailpile.is&#x2F;blog&#x2F;2014-10-07_Some_Thoughts_on_Gnu...</a>