Post #1686511
2025-10-14 14:14 UTC
Does your org run a self-managed version of GitLab and publish your own #Python packages to @pypi ?
If you want to try out an alpha of Trusted Publishing for GitLab Self-Managed instances, let me know via DM - I'm collecting interest now, and should have something to show soon.
Replies (3)
-
@sethmlarson@mastodon.social 2025-10-14 14:24
@miketheman @pypi cc @vagrantc maybe the Reproducible Builds folks are interested in this? :)
-
@vagrantc@floss.social 2025-10-14 16:19
@miketheman @pypi What sort of "Trusted Publishing" does this do? Signed packages? Provide sufficient information to attempt and verify #ReproducibleBuilds ? Chains of Provenance?
-
@matmair@mastodon.social 2025-10-14 19:30
@miketheman @pypi Not a Gitlab user, just running a small gitea instance. Is there an issue, blog or PR I could follow to read more about your approach once it is published?