3 ms·
To create a new package, you MUST generate a global token that can also do whatever on all existing packages on the account. How many people do you think will
by LtWorf 3y ago
To create a new package, you MUST generate a global token that can also do whatever on all existing packages on the account.
How many people do you think will bother to delete the global token after having used it, and then generate a scoped one? 1%? Probably much less than that.
- woodruffw 3y agoYou can create a new package via a "pending publisher"[1], which does not require a user-scoped token. (Note: even though PyPI calls them "user-scoped tokens," they have less access than a password does, since they can't manage the user's account itself. So, while not ideal, they are still a better choice than a user/pass combination.) [1]: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/ https://docs.pypi.org/trusted-publishers/creating-a-project-...
- LtWorf 3y agoOh they've listened to me at least.