Post #851592
2026-03-26 04:05 UTC
Replies (7)
-
@jni@fosstodon.org 2026-03-26 04:28
@brettcannon Amazing, thank you! Indeed thank you to all the PyPA folks who implemented trusted publishing, thanks to whom napari automagically ticked box 2 after ticking box 1: https://pypi.org/project/napari/0.7.0/#napari-0.7.0-py3-none-any.whl and thank you very much for the blog post which made it easy for go check that! We still use requirements.txt files for our CI constraints, though, so we'll look into migrating to pylock.toml!
-
@ryanhiebert@fosstodon.org 2026-03-26 04:44
@brettcannon this seems like it really puts new platforms at a disadvantage if security only comes from having enough money to convince pypi that you’re good enough to be a trusted publisher. If codeberg can’t get it even though many people are using it, that really makes it difficult.
-
@fschulze@mastodon.social 2026-03-26 04:57
@brettcannon as far as I understand the developer account was compromised and the bad payload was commited to the repository, so trusted publishing would have created a valid release and you wouldn’t have noticed anything. Did I miss something?
-
@tmr232@mastodon.social 2026-03-26 05:02
@brettcannon @jni thanks! This makes things a lot clearer for me!
-
@fallenhitokiri@social.screamingatmyscreen.com 2026-03-26 08:02
@brettcannon if I understand the workflow and requirements correctly I’d need to move CI and signing to one of the few blessed systems such as Microsoft’s falling apart slop dumpster fire. If this is correct I honestly hope it causes the opposite reaction and people start looking into / working on alternatives instead of using the system as is.
-
@hugovk@mastodon.social 2026-03-26 08:59
@brettcannon Thanks for this writeup! "What can you do as a person if you don't have code to check that things line up (which isn't a lot of code; the lock file should have the index server for the package, so you follow the index server API to get the digital attestation for each file and compare)?" Let's build this into common tooling! Directly into installers like pip and uv? And pip/uv audit? #Python #security
-
@saucoide@fosstodon.org 2026-03-26 11:19
@brettcannon @jni what am i missing? I dont see any publisher information on `pylock.toml`, generated with any of `uv`, `pip` or `pdm`, are the tools choosing not to include it at the moment or am I doing something wrong?