Security

Distributors are recommended to fetch release sources via the Git tags on our repository, or the source distributions on the meson-python PyPI page, both are PGP-signed with one of the following keys:

• 3DCE51D60930EBA47858BA4146F633CBB0EB4BF2 (Filipe Laíns)

• 52BDC33FD1FBAB569D47FFA923D9E5499A08BDC5 (Ralf Gommers)

Fetching artifact signatures from PyPI

To fetch the PGP signatures for artifacts on PyPI, simply add .asc to the artifact URL.