meshy / pythonwheels

Adoption analysis of Python Wheels: https://pythonwheels.com/
BSD 2-Clause "Simplified" License
102 stars 26 forks source link

Caveats on wheel signing functionality #31

Closed vsajip closed 10 years ago

vsajip commented 10 years ago

The site highlights "secure digital signing" as a feature of wheels. Wheel signing is not a mandatory part of the wheel spec, and not everyone is convinced that a wheel-specific signing mechanism is of any benefit - for example, see this post. OTOH, signing using GPG is available for any file, and has been for a long time - it's not confined to wheels. Common to both signing approaches is the lack of web-of-trust, but that's a separate issue altogether.

So, I think this mention of signing in a wheel-specific context muddies the waters, and is best removed. Instead, you are better off mentioning another benefit of wheels: no compiler is required for installation (mainly a benefit on Windows, I know).

LilyFoote commented 10 years ago

Fixed in 2ddcb0e.