Post #776120
2026-03-24 17:27 UTC
RE: https://infosec.exchange/@dangoodin/116285175398594132
Notice how the compromised releases were directly uploaded. This is why `pylock.toml` includes attestation data and trusted publishing is important. If the project used trusted publishing then their the lack of attestation data could have been noticed in a diff of the lock file as it would have suddenly disappeared (which is also why `pylock.toml` was designed to be human-readable).
Replies (2)
-
@sethmlarson@mastodon.social 2026-03-24 17:34
@brettcannon Can't tell you how often I'm bothered by a lock file being marked as "generated" or "too long to be human readable" on code review platforms. If we're not looking at lock files... how do we know what code is running?? Human readability of pylock.toml is👌
-
@jni@fosstodon.org 2026-03-25 02:54
@brettcannon @pjacock @dangoodin do you have a human- (read: noob-) readable intro to these concepts? I don’t think we use pylock in any of the projects I lead. 😬