Viewing profile — di

Maven Central does not currently support OIDC-based authentication (commonly called "Trusted Publishing").

For some context on the scale of this grant, the PSF took in only $1M in "Contributions, Membership Dues, & Grants" in 2024: https://www.python.org/psf/annual-report/2024/

It says "September 23, 2025" right at the top.

Don't be embarrassed, it's a good book (and was my favorite too).

Note that https://peps.python.org/pep-0440/#direct-references says: > Public index servers SHOULD NOT allow the use of direct references in uploaded distributions. Direct reference…

This is why PyPI recommends using Trusted Publishing ( https://docs.pypi.org/trusted-publishers/ ) which removes the need for long-lived tokens entirely.

That article is about the packaging summit talk on introducing namespaces, not about organizations. In fact, when talking about organizations, it explicitly says: > But support for…

> An example of this is that PyPI just got the ability to namespace packages. You're thinking of organizations, which are not namespaces: https://blog.pypi.org/posts/2023-04-23-int…

Pip supports checksums too. A better link might be https://pip.pypa.io/en/stable/topics/secure-installs/

PyPI has never supported 2FA via SMS.

Periods are not prohibited in package names, they're just uncommon (e.g., https://pypi.org/project/zope.sqlalchemy/ )

Gitlab also doesn't support customizable OIDC audiences yet: https://gitlab.com/groups/gitlab-org/-/epics/7335