In the Register your Project section, it is suggested to directly upload the PKG-INFO file instead of invoking python setup.py register, which didn't use secure connections previously and thus exposed credentials over network in plaintext.
The twine readme states that https is being used now (since 2.7 and 3.2, two years ago), but the cert is not verified according to the referenced issue. I couldn't find any mention about SSL/TLS certs being verified now, however.
Could you maybe answer the question in the title and update the user guide to mention the Python versions where this is fixed, if it is the case? Does setuptools even rely on distutils or would that issue be fixed elsewhere?
Edit: How about python setup.py ... upload, too?
In the Register your Project section, it is suggested to directly upload the
PKG-INFOfile instead of invokingpython setup.py register, which didn't use secure connections previously and thus exposed credentials over network in plaintext.The twine readme states that https is being used now (since 2.7 and 3.2, two years ago), but the cert is not verified according to the referenced issue. I couldn't find any mention about SSL/TLS certs being verified now, however.
Could you maybe answer the question in the title and update the user guide to mention the Python versions where this is fixed, if it is the case? Does
setuptoolseven rely ondistutilsor would that issue be fixed elsewhere?Edit: How about
python setup.py ... upload, too?