3 ms·

According to this page, urllib3 does not use trusted publishing. According to https://docs.pypi.org/project_metadata/#verified-details https://docs.pypi.org/pro

According to this page, urllib3 does not use trusted publishing. According to https://docs.pypi.org/project_metadata/#verified-details https://docs.pypi.org/project_metadata/#verified-details , trusted publishing and self-links are the only ways to have "verified details". However https://pypi.org/project/urllib3/ https://pypi.org/project/urllib3/ shows Changelog/Code/Issue tracker as "Verified details" even though they are not self-links. How come? urllib3 does not have a recent release that could explain https://trailofbits.github.io/are-we-pep740-yet/ https://trailofbits.github.io/are-we-pep740-yet/ lagging behind.

darkamaul 2y ago
This page only shows if a package has been uploaded with attestations .The verified details (Changelog/Code/Issue tracker) are showing because they do use Trusted Publishing. However, they have not published a new version since the beginning of attestation support in PyPI. That's the meaning of the clock icon right to the package name. Their workflow responsible for publishing new releases [1] has support for attestations. Thus, it will turn green on this page with the next project release. [1] https://github.com/urllib3/urllib3/blob/main/.github/workflows/publish.yml#L94 https://github.com/urllib3/urllib3/blob/main/.github/workflo...