Post #1889288
2025-10-14 16:19 UTC
@miketheman @pypi
What sort of "Trusted Publishing" does this do?
Signed packages? Provide sufficient information to attempt and verify #ReproducibleBuilds ? Chains of Provenance?
Replies (1)
-
@miketheman@hachyderm.io 2025-10-14 16:22
@vagrantc TL,DR: using OIDC to generate short-lived access tokens to publish from known publishers. Lots of docs: https://docs.pypi.org/trusted-publishers/