4 ms·
> which (1) is unnecessarily exclusionary meanwhile pypa spent months making it so the only trusted publisher is microsoft
by blibble 3y ago
> which (1) is unnecessarily exclusionary
meanwhile pypa spent months making it so the only trusted publisher is microsoft
- woodruffw 3y agoThis is misleading: the trusted publisher is GitHub's OIDC IdP, which happens to be the single most common publishing source for PyPI (as well as the first IdP to give us all the features we needed). It has absolutely nothing to do with Microsoft; I don't think Microsoft (as a discrete corporate entity) was even aware of the work. The feature was intentionally built to be extensible and to support additional publishers. I know this because I'm the one who made it extensible, and who's working on supporting them[1][2]. [1]: https://github.com/pypi/warehouse/issues/13551 https://github.com/pypi/warehouse/issues/13551 [2]: https://github.com/pypi/warehouse/issues/13575 https://github.com/pypi/warehouse/issues/13575