4 ms·
Great, now how do you use attestations with Twine when publishing packages on PyPI outside of the Github ecosystem?
by cpburns2009 2y ago
Great, now how do you use attestations with Twine when publishing packages on PyPI outside of the Github ecosystem?
- hifromwork 2y agoYou need to rely on one of the four trusted publishers. You can't do it yourself: https://docs.pypi.org/trusted-publishers/adding-a-publisher/ https://docs.pypi.org/trusted-publishers/adding-a-publisher/
- guappa 2y agoYou don't. The whole point is that you can no longer sign anything. Microsoft signs for you. And of course the signature means "this user can push to github" and nothing more.
- remram 2y agoHopefully the attestation is bound to a specific commit, so you can know the binaries came from the source? Otherwise I don't get it.
- guappa 2y agoIt doesn't seem to be from what I can see. Only states that the upload came from a gh runner.
- woodruffw 2y agoYes, it’s bound to a specific commit; we just don’t present that in the web UI yet. If you click on the transparency log entry, you’ll see the exact commit the attestation came from.