5 ms·
Except that also for trusted publishing, they only allowed github in the beginning and eventually added a couple of other providers. But if you're not google or
by guappa 2y ago
Except that also for trusted publishing, they only allowed github in the beginning and eventually added a couple of other providers. But if you're not google or microsoft you won't be added.
- woodruffw 2y agoThese kinds of comments are borderline mendacious: you can observe, trivially, that 50% of the Trusted Publishers currently known to PyPI are neither Google nor Microsoft controlled[1]. If PyPI accepts two more likely ones, a full 2/3rds will unrelated to GitHub. [1]: https://docs.pypi.org/trusted-publishers/adding-a-publisher/ https://docs.pypi.org/trusted-publishers/adding-a-publisher/
- guappa 2y agoPing me when one of them will be an open source entity rather than a company.
- woodruffw 2y agohttps://docs.pypi.org/trusted-publishers/internals/#how-do-i-become-a-trusted-publishing-provider https://docs.pypi.org/trusted-publishers/internals/#how-do-i...
- cpburns2009 2y agoWow, you can use a whole two other providers from your list: Gitlab and ActiveState. Color me unimpressed.
- immibis 2y agoWow. I get to choose one from a total of FOUR large corporations! Amazing openness!
- woodruffw 2y agoOnce again: this is constrained by design. If you don’t want to use OpenID Connect, just create a token on PyPI and publish the normal way. You are not, and will never be, required to use this feature.