2 ms·
>OIDC Authenticated Publishers That also strikes bad since GitHub Actions isn't a publisher anyways. To me, a package "publisher" is basically just the author.
by Hamuko 4y ago
>OIDC Authenticated Publishers
That also strikes bad since GitHub Actions isn't a publisher anyways. To me, a package "publisher" is basically just the author. Here it's a CI system or a builder. "Trusted builders" or "trusted pushers" would've made a lot more sense, since the trust is applying to the build system, not the publisher.
- formerly_proven 4y agoIf you write trusted pusher one time too many on an open channel the War on Drugs guys are going to bust your door down.
- skissane 4y ago> To me, a package "publisher" is basically just the author. At work, we keep on calling the CI stage which uploads the build artifacts to Artifactory the "publish" stage. Maybe that's the wrong terminology but I've got used to it. And if "publish" is what the stage is doing, it kind of makes sense to call it a "publisher". Maybe that's wrong, especially in the context of PyPI, but it doesn't sound wrong to me.