{"action":"created","issue":{"url":"https://api.github.com/repos/pypa/pipenv/issues/1735","repository_url":"https://api.github.com/repos/pypa/pipenv","labels_url":"https://api.github.com/repos/pypa/pipenv/issues/1735/labels{/name}","comments_url":"https://api.github.com/repos/pypa/pipenv/issues/1735/comments","events_url":"https://api.github.com/repos/pypa/pipenv/issues/1735/events","html_url":"https://github.com/pypa/pipenv/issues/1735","id":305164802,"number":1735,"title":"Support verification of GnuPG signed packages","user":{"login":"ovalseven8","id":8258609,"avatar_url":"https://avatars2.githubusercontent.com/u/8258609?v=4","gravatar_id":"","url":"https://api.github.com/users/ovalseven8","html_url":"https://github.com/ovalseven8","followers_url":"https://api.github.com/users/ovalseven8/followers","following_url":"https://api.github.com/users/ovalseven8/following{/other_user}","gists_url":"https://api.github.com/users/ovalseven8/gists{/gist_id}","starred_url":"https://api.github.com/users/ovalseven8/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ovalseven8/subscriptions","organizations_url":"https://api.github.com/users/ovalseven8/orgs","repos_url":"https://api.github.com/users/ovalseven8/repos","events_url":"https://api.github.com/users/ovalseven8/events{/privacy}","received_events_url":"https://api.github.com/users/ovalseven8/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-14T13:47:11Z","updated_at":"2018-03-14T13:50:35Z","closed_at":"2018-03-14T13:47:39Z","author_association":"NONE","body":"You can upload packages to PyPI and sign the distributions using GnuPG with `twine` (https://packaging.python.org/tutorials/distributing-packages/#upload-your-distributions).\r\n\r\nMy recommendation for `pipenv` is that you can (optionally) add a GnuPG key to the piplock file for packages. The update or installation process will then only work if the packages has been signed with the correct GnuPG key.\r\n\r\nWhile I agree that `pipenv` should not add too many features and focus on being relatively lighweight and functional, I think this is an important issue because of security. Manually veryfing signatures is not the way to go.\r\n"},"comment":{"url":"https://api.github.com/repos/pypa/pipenv/issues/comments/373027284","html_url":"https://github.com/pypa/pipenv/issues/1735#issuecomment-373027284","issue_url":"https://api.github.com/repos/pypa/pipenv/issues/1735","id":373027284,"user":{"login":"ovalseven8","id":8258609,"avatar_url":"https://avatars2.githubusercontent.com/u/8258609?v=4","gravatar_id":"","url":"https://api.github.com/users/ovalseven8","html_url":"https://github.com/ovalseven8","followers_url":"https://api.github.com/users/ovalseven8/followers","following_url":"https://api.github.com/users/ovalseven8/following{/other_user}","gists_url":"https://api.github.com/users/ovalseven8/gists{/gist_id}","starred_url":"https://api.github.com/users/ovalseven8/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ovalseven8/subscriptions","organizations_url":"https://api.github.com/users/ovalseven8/orgs","repos_url":"https://api.github.com/users/ovalseven8/repos","events_url":"https://api.github.com/users/ovalseven8/events{/privacy}","received_events_url":"https://api.github.com/users/ovalseven8/received_events","type":"User","site_admin":false},"created_at":"2018-03-14T13:50:35Z","updated_at":"2018-03-14T13:50:35Z","author_association":"NONE","body":"I'd at least know some reason why this has been closed several seconds after I created the issue."}}
{"actor":{"display_login":"ovalseven8"}}