Post #1834540

2026-03-28 02:38 UTC

@fallenhitokiri First, I work at MS; I don't expect you to necessarily agree with the trajectory of the company but it did pay for that blog post, so please keep the insults civil. Two, you can work with whomever you have hosting your code to become trusted enough to use trusted publishing. Or you can work to make a system where trusted publishing isn't a prerequisite.

Replies (4)

@brettcannon@mastodon.social 2026-03-28 03:25

@fallenhitokiri as well, check out disulciss.python.org where there was a recent discussion as to why Codeberg isn't a trusted publisher yet and what it takes.

Open ##1834541
@fallenhitokiri@social.screamingatmyscreen.com 2026-03-28 06:00

@brettcannon per the thread there doesn’t seem to be a way to establish any new providers outside of the blessed ones when 7 years is considered “too young”. The technical / operational concerns are valid IMHO. The maturity argument also falls very short when you objectively look at the trajectory of a blessed provider with outages piling up. The example with SourceForge in the discussion is a perfect example for that and also why blessed providers are not the way to go.

Open ##1834542
@fallenhitokiri@social.screamingatmyscreen.com 2026-03-28 06:04

@brettcannon Based on the discuss. thread I agree that a system not requiring trusted publishing is what we should be working towards to. With the arguments in the thread it’s just hard to see how. Many of the properties of a “trusted” way of doing things discussed are inherently incompatible with any new development.

Open ##1834545
@fallenhitokiri@social.screamingatmyscreen.com 2026-03-28 06:09

@brettcannon also sorry for the less civil part of the comment. I didn’t know you are at MS and that the blog post was sponsored / written as part of your job, I usually try to be more factual when engaging with content like this.

Open ##1834546