Post #776118
2026-03-25 14:19 UTC
Replies (6)
-
@cthoyt@scholar.social 2026-03-25 14:39
@jonafato@mastodon.social you should check out @andrewnez@mastodon.social on fedi and his blog, he's been writing about this topic a lot in the last few months
-
@hipsterelectron@circumstances.run 2026-03-25 15:18
@jonafato@mastodon.social relatedly from the trusted publishing docs https://docs.pypi.org/trusted-publishers/security-model/ GitHub Actions' own security model for OpenID Connect tokens is a little subtle: and furthermore (emphasis not mine): PyPI has protections in place to make some attacks against OIDC more difficult (like account resurrection attacks). However, like all forms of authentication, the end user is fundamentally responsible for applying it correctly. when pgp keys were removed from pypi, a lengthy justification was provided by the same engineer who developed the trusted publishing workflow regarding the difficulty in using them correctly (which was itself flawed but that's a separate topic). there are in these cases (as you note) no specific protections ensured, while alternatives are removed. it's a really upsetting tradeoff to provide to the community and it's a pattern of behavior that has advanced in recent years.
-
@sdwilsh@social.ridetrans.it 2026-03-25 16:40
@jonafato@mastodon.social That's because we all know getting GitHub to implement features like that is near impossible 😅
-
@djspiewak@fosstodon.org 2026-03-25 19:20
@jonafato@mastodon.social @ross@social.rossabaker.com I mean I agree with what you're saying, but maybe I'm missing something, because it feels like this type of tooling is almost trivial to implement yourself if you're willing to inline the locking and add some ignored YAML.
-
@hugovk@mastodon.social 2026-03-25 20:51
@jonafato@mastodon.social 2022: "We are building a new way to publish and consume actions that will improve the security of the CI/CD supply chain." 2025: closed as not planned https://github.com/actions/publish-immutable-action
-
@scigrapher@dungeoncrawler.world 2026-03-25 21:36
@jonafato@mastodon.social likely because one is something actionable by those it affects and the other is a (justifiable) opinion. Hopes and prayers don't solve problems.