4 ms·

I wrote a good chunk of those docs, and I can assure you that the goal is always to add more identity providers, and not to enforce support for any particular p

I wrote a good chunk of those docs, and I can assure you that the goal is always to add more identity providers, and not to enforce support for any particular provider. GitHub was only the first because it’s popular; there’s no grand evil theory beyond that.

VorpalWay 10mo ago
So if I self host my own gitea/forgejo instance, will trusted publishing work for me?
- eesmith 10mo ago
  According to their docs, they have a "have high standards for overall reliability and security in the operation of a supported Identity Provider: in practice, this means that a home-grown or personal use IdP will not be eligible." If you think your setup meets those standards, you'll need to use Microsoft (TM) GitHub (R) to contact them.
  - VorpalWay 10mo ago
    In other words, it is a clear centralization drive. No two ways about it.
    - jopsen 10mo ago
      npm is centralized to start with, so how is this a problem?
    - eesmith 10mo ago
      PyPI is already centralized. Back when I started with PyPI, manual upload through the web interface was the only possibility. Have they gotten rid of that? My understanding is that "trusted publishing"[0] was meant as an additional alternative to that sort of manual processing. It was never decentralized. As I recall, the initial version only supported GitHub and (I think) GitLab. [0] I do not trust Microsoft as an intermediary to my software distribution. I don't use Microsoft products or services, including GitHub. Yes, this makes contacting PyPI support via GitHub impossible for me. That is one of the reasons I stopped using PyPI and instead distribute my wheels from my own web site.
- woodruffw 10mo ago
  If you had enough users and demonstrated the ability to securely manage a PKI, then I don’t see why not. But if it’s just you on a server in your garage, then there would be no advantage to either you or to the ecosystem for PyPI to federate with your server. That’s why API tokens are still supported as a first-class authentication mechanism: Trusted Publishing is simply not a good fit in all possible scenarios.
  - pamcake 10mo ago
    > if it’s just you on a server in your garage, then there would be no advantage to either you or to the ecosystem for PyPI to federate with your server. Why not leave decision on what providers to trust to users, instead of having a centrally managed global allowlist at the registry? Why should he registry admin be the one to decide who is fit to publish for each and all packages?
    - acdha 10mo ago
      They’re running the most popular registry but nothing says you can’t use your own to implement whatever policy you want. The default registry has a tricky balance of needing to support inexperienced users while also only having a very modest budget compared to the companies which depend on it, and things like custom authentication flows are disproportionately expensive.
      - pamcake 10mo ago
        What's the issue exactly? They seem to manage to handle account signups with email addresss from unknown domain names just as fine as for hotmail.com and gmail.com. I don't see how this is any different. The whole point of standards like OIDC (and supposedly TP) is that there is no need for provider-specific implemenations or custom auth flows as long as you follow the spec and protocol. It's just some fields that can be put in a settings UI configurable by the user.
        woodruffw 10mo ago

VorpalWay 10mo ago

So if I self host my own gitea/forgejo instance, will trusted publishing work for me?

eesmith 10mo ago
According to their docs, they have a "have high standards for overall reliability and security in the operation of a supported Identity Provider: in practice, this means that a home-grown or personal use IdP will not be eligible." If you think your setup meets those standards, you'll need to use Microsoft (TM) GitHub (R) to contact them.
- VorpalWay 10mo ago
  In other words, it is a clear centralization drive. No two ways about it.
  - jopsen 10mo ago
    npm is centralized to start with, so how is this a problem?
  - eesmith 10mo ago
    PyPI is already centralized. Back when I started with PyPI, manual upload through the web interface was the only possibility. Have they gotten rid of that? My understanding is that "trusted publishing"[0] was meant as an additional alternative to that sort of manual processing. It was never decentralized. As I recall, the initial version only supported GitHub and (I think) GitLab. [0] I do not trust Microsoft as an intermediary to my software distribution. I don't use Microsoft products or services, including GitHub. Yes, this makes contacting PyPI support via GitHub impossible for me. That is one of the reasons I stopped using PyPI and instead distribute my wheels from my own web site.
woodruffw 10mo ago
If you had enough users and demonstrated the ability to securely manage a PKI, then I don’t see why not. But if it’s just you on a server in your garage, then there would be no advantage to either you or to the ecosystem for PyPI to federate with your server. That’s why API tokens are still supported as a first-class authentication mechanism: Trusted Publishing is simply not a good fit in all possible scenarios.
- pamcake 10mo ago
  > if it’s just you on a server in your garage, then there would be no advantage to either you or to the ecosystem for PyPI to federate with your server. Why not leave decision on what providers to trust to users, instead of having a centrally managed global allowlist at the registry? Why should he registry admin be the one to decide who is fit to publish for each and all packages?
  - acdha 10mo ago
    They’re running the most popular registry but nothing says you can’t use your own to implement whatever policy you want. The default registry has a tricky balance of needing to support inexperienced users while also only having a very modest budget compared to the companies which depend on it, and things like custom authentication flows are disproportionately expensive.
    - pamcake 10mo ago
      What's the issue exactly? They seem to manage to handle account signups with email addresss from unknown domain names just as fine as for hotmail.com and gmail.com. I don't see how this is any different. The whole point of standards like OIDC (and supposedly TP) is that there is no need for provider-specific implemenations or custom auth flows as long as you follow the spec and protocol. It's just some fields that can be put in a settings UI configurable by the user.
      - woodruffw 10mo ago