@kravietz @stman At least pip allows hashing packages, but that doesn't really help against typo squatting.

@clacke @stman

Correct. And PyPi.org does ensure unique package names but then it doesn't really help - I've just spend half hour debugging an issue caused by the fact I installed "yara" package while the one I wanted is called "yara-python" 🤦‍♂️

@kravietz @stman Not sure how signed packages help against typosquatting either, though. Would you have known that one author rather than the other was behind yara-python? What keys do you accept?

@clacke @stman

Sorry if I was unclear, but that's exactly what I meant... They don't.

What does help is some kind of reputation measurements in the first place (likes, downloads, "verified suppliers") and only then digital signatures to prevent spoofing.