Post #1054126

2026-03-26 04:44 UTC

@brettcannon this seems like it really puts new platforms at a disadvantage if security only comes from having enough money to convince pypi that you’re good enough to be a trusted publisher. If codeberg can’t get it even though many people are using it, that really makes it difficult.

Replies (3)

@ryanhiebert@fosstodon.org 2026-03-26 04:46

@brettcannon I get that we wouldn’t want bad actors as trusted publishers, but I do wonder if we’re being too careful on allowing new trusted publishers, since we do require the trusted publisher to be authorized by the specific project, inherently limiting the damage. Re-upping the recent thread on the discussion board, it seems like there is at least some sentiment in that direction.

Open ##1834532
@carlton@chaos.social 2026-03-26 06:12

@ryanhiebert @brettcannon yes… 🤔 I’m really happy to jump through any kind of local signing flow, such that “yep, that was definitely me” but delegating releases to the oligopoly is not progress. Alas.

Open ##1834537
@sethmlarson@mastodon.social 2026-03-26 13:29

@ryanhiebert @brettcannon yeah, we need to figure out how we can provide some link to tie an archive on PyPI back to a claimed source code reference (whether that's git or a URL). Especially now that many folks are self-hosting their infrastructure. What comes to my mind is focusing on build reproducibility, submitting a "claim" within a package (source code ref, build backend version, tool versions, etc) and having that claim verified by another party.

Open ##1834538