3 ms·
This is misleading: the trusted publisher is GitHub's OIDC IdP, which happens to be the single most common publishing source for PyPI (as well as the first IdP
by woodruffw 3y ago
This is misleading: the trusted publisher is GitHub's OIDC IdP, which happens to be the single most common publishing source for PyPI (as well as the first IdP to give us all the features we needed). It has absolutely nothing to do with Microsoft; I don't think Microsoft (as a discrete corporate entity) was even aware of the work.
The feature was intentionally built to be extensible and to support additional publishers. I know this because I'm the one who made it extensible, and who's working on supporting them[1][2].
[1]: https://github.com/pypi/warehouse/issues/13551 https://github.com/pypi/warehouse/issues/13551
[2]: https://github.com/pypi/warehouse/issues/13575 https://github.com/pypi/warehouse/issues/13575