Post #2869148
2025-11-27 23:31 UTC
@miketheman@hachyderm.io it's not clear to me how trusted publishing helps in the case of something like Shai-Hulud: if your repo is corrupted, the corrupted package will be pushed to PyPi via the CI and propagated anyway, isn't it?
Replies (1)
-
@miketheman@hachyderm.io 2025-11-27 23:59
@silmathoron@floss.social you are correct that you always need to secure your repository permissions regardless. With this facet of Shai-Hulud, repositories' stored secrets were exposed, and Trusted Publishing removes the need to store secrets at all.