Skip to content

Same as snaps. Pypi by default should not be trusted #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
javierdelapuente merged 2 commits into from
Feb 3, 2026
Merged

Same as snaps. Pypi by default should not be trusted #93

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ad9800
Same as snaps. Pypi by default should not be trusted
javierdelapuente Nov 27, 2025
7a067e1
split line
javierdelapuente Nov 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,11 +138,12 @@ versions.
Downloading binaries is only permitted from what are classed as trusted sources.
These are:

* The Ubuntu Archives (for debian packages)
* Snaps
* The Ubuntu Archives (for debian packages).
* Snaps.
[owned by the "canonical" account](https://snapcraft.io/publisher/canonical)
* Snaps where the binary is built from a trusted and approved source.
* [PyPi](https://pypi.org/)
* [PyPi](https://pypi.org/) where the binary is built from a trusted and
approved source.

These sources are considered trusted because we are confident that we understand
the way in which they're built, and the security commitments for packages/snaps
Expand Down