4 ms·
> error-prone cryptographic bits if they don't need to They can't. Because you wouldn't accept their key anyway.
by guappa 2y ago
> error-prone cryptographic bits if they don't need to
They can't. Because you wouldn't accept their key anyway.
- woodruffw 2y agoI think you're missing something. The key in question is a short-lived ECDSA key that lives inside a publishing workflow and is destroyed after signing; neither GitHub nor the Sigstore CA generates a signing key for you. PyPI will accept any key bound to an identity, provided we know how to verify that identity. Right now that means we accept Trusted Publishing identities, and GitHub identities in particular, since that's where the overwhelming majority of Python package publishing traffic comes from. Like what happened Trusted Publishing, this will be expanded to other identities (like GitLab repositories) as we roll it out.
- guappa 2y agoHow does pypi know I'm not github? Because I can sign with my keys and not with github's key. Never mind all the low level details of the temporary keys and hashes and all of that. This is an high level comment not a university book about security.