Re: [python-committers] Do people prefer pushing feature repos or one massive patch?

2015-04-03 Thread Nick Coghlan
On 2 April 2015 at 22:06, Jason R. Coombs wrote: > I'm in the other camp. > > The way I see it, a squash of history or massive patch file loses history. It > loses details about the thought process of the implementer. It masks mistakes > and obscures motivations. It also masks decisions made in

Re: [python-committers] Do people prefer pushing feature repos or one massive patch?

2015-04-03 Thread Victor Stinner
Hi, FYI the faulthandler and tracemalloc were both added in a single commit, while they added a lot of new code and modified multiple files. The development of faulthandler and tracemalloc started as third party projects on PyPI. I almost rewrote tracemalloc from scratch while its PEP was discus

[python-committers] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Larry Hastings
As of Python 3.5 Steve Dower has taken over the Windows builds of Python from Martin van Loewis. He's also taken over for 2.7--though Martin's still doing builds for 3.4. For both versions, Steve is using all-new tooling for the build process. The output is different, too; he's producing

Re: [python-committers] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread M.-A. Lemburg
On 03.04.2015 11:56, Larry Hastings wrote: > My Windows development days are firmly behind me. So I don't really have an > opinion here. So I put > it to you, Windows Python developers: do you care about GnuPG signatures on > Windows-specific files? > Or do you not care? Regardless of target

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Paul Moore
On 3 April 2015 at 10:56, Larry Hastings wrote: > My Windows development days are firmly behind me. So I don't really have an > opinion here. So I put it to you, Windows Python developers: do you care > about GnuPG signatures on Windows-specific files? Or do you not care? I don't have a very s

Re: [python-committers] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Barry Warsaw
On Apr 03, 2015, at 02:56 AM, Larry Hastings wrote: >My Windows development days are firmly behind me. So I don't really have an >opinion here. So I put it to you, Windows Python developers: do you care >about GnuPG signatures on Windows-specific files? Or do you not care? They're not mutually

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Brian Curtin
On Fri, Apr 3, 2015 at 7:25 AM, Paul Moore wrote: > On 3 April 2015 at 10:56, Larry Hastings wrote: >> My Windows development days are firmly behind me. So I don't really have an >> opinion here. So I put it to you, Windows Python developers: do you care >> about GnuPG signatures on Windows-spe

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Steve Dower
Larry Hastings wrote: > Steve's also changed the authentication process. His new installers rely on a > Windows digital signature technology called Authenticode where the signature > is > built right into the .exe file. Windows platforms will automatically > authenticate executables signed with Au

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread M.-A. Lemburg
On 03.04.2015 19:35, Steve Dower wrote: >> My Windows development days are firmly behind me. So I don't really have an >> opinion here. So I put it to you, Windows Python developers: do you care >> about >> GnuPG signatures on Windows-specific files? Or do you not care? > > The later replies seem

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Steve Dower
The thing is, that's exactly the same goodness as Authenticode gives, except everyone gets that for free and meanwhile you're the only one who has admitted to using GPG on Windows :) Basically, what I want to hear is that GPG sigs provide significantly better protection than hashes (and I can p

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread M.-A. Lemburg
On 04.04.2015 00:14, Steve Dower wrote: > The thing is, that's exactly the same goodness as Authenticode gives, except > everyone gets that for free and meanwhile you're the only one who has > admitted to using GPG on Windows :) > > Basically, what I want to hear is that GPG sigs provide signifi

Re: [python-committers] [Python-Dev] Do we need to sign Windows files with GnuPG?

2015-04-03 Thread Donald Stufft
> On Apr 3, 2015, at 6:38 PM, M.-A. Lemburg wrote: > > On 04.04.2015 00:14, Steve Dower wrote: >> The thing is, that's exactly the same goodness as Authenticode gives, except >> everyone gets that for free and meanwhile you're the only one who has >> admitted to using GPG on Windows :) >> >>