2 ms·

I think you are only considering people who use a CI to do an upload. Do you have any data of how many pypi projects are set up this way in total? I upload fro

by guappa 3y ago

I think you are only considering people who use a CI to do an upload. Do you have any data of how many pypi projects are set up this way in total? I upload from my machine, where a token.txt is stored on the same disk as the .ssh file. So your game over scenario is identical in both cases for me. > people using permanent user-scoped tokens everywhere I'd say that's a major design flaw of pypi, that it is impossible to create per-package scoped tokens directly, unless one is configuring trusted publishers (which translates to github). > which lives in a security module for me I am very confident that this is extremely uncommon among authors of projects hosted by pypi. Is this a mandate from your employer? (I don't know who that might be and if it is related at all, just asking.)

woodruffw 3y ago
No, I don’t have those numbers on hand. If you upload from your local machine, none of this applies to you. It only applies to people using CI to upload, who want to reduce the overall scope of their shared access by not relying on permanent credentials. That’s the whole point of trusted publishing; it has nothing to do with locally initiated uploads. > I'd say that's a major design flaw of pypi, that it is impossible to create per-package scoped tokens directly, unless one is configuring trusted publishers (which translates to github). I think you’ve misunderstood. PyPI allows you to create project scoped tokens completely independent of trusted publishing. Trusted publishing is only distinguished in that the scopes are automatic, meaning that the user cannot overscope their token. The point about security modules is a red herring; it was supposed to emphasize that this is outside of PyPI’s domain of interest. But no, I do it for myself, not because my employer requires it.
- guappa 3y ago
  Well it would be interesting to have the numbers, to know how important it is to focus on defending uploads from CI vs uploads from developer machines. > PyPI allows you to create project scoped tokens It requires the creation of a non-scoped token first, to do that. And since people are lazy I'd bet many have not created a scoped token. Again, this is supposition from my part that could be verified or proven wrong by you.

by guappa 3y ago

woodruffw 3y ago

No, I don’t have those numbers on hand. If you upload from your local machine, none of this applies to you. It only applies to people using CI to upload, who want to reduce the overall scope of their shared access by not relying on permanent credentials. That’s the whole point of trusted publishing; it has nothing to do with locally initiated uploads. > I'd say that's a major design flaw of pypi, that it is impossible to create per-package scoped tokens directly, unless one is configuring trusted publishers (which translates to github). I think you’ve misunderstood. PyPI allows you to create project scoped tokens completely independent of trusted publishing. Trusted publishing is only distinguished in that the scopes are automatic, meaning that the user cannot overscope their token. The point about security modules is a red herring; it was supposed to emphasize that this is outside of PyPI’s domain of interest. But no, I do it for myself, not because my employer requires it.

guappa 3y ago
Well it would be interesting to have the numbers, to know how important it is to focus on defending uploads from CI vs uploads from developer machines. > PyPI allows you to create project scoped tokens It requires the creation of a non-scoped token first, to do that. And since people are lazy I'd bet many have not created a scoped token. Again, this is supposition from my part that could be verified or proven wrong by you.