41–43 of 43 posts
Is the compute and network required to service pypi all from donations or do they have any business arm that generates income?
> Trusted Publishing Why do people come up with such unbelievably complex solutions that don’t actually achieve what a simple solution could do? Trusted Publishing approximately involves a service like GitHub proving to somebody that some release artifact came from a GitHub Actions workflow file with a particular name, possibly in a particular commit. Never mind that GitHub Actions is an unbelievable security nightma…
Why not Just(TM) enforce a reproducible build process? That brings some of its own challenges, but would represent a real upgrade over building out some Swiss cheese like this.
> Trusted Publishing Why do people come up with such unbelievably complex solutions that don’t actually achieve what a simple solution could do? Trusted Publishing approximately involves a service like GitHub proving to somebody that some release artifact came from a GitHub Actions workflow file with a particular name, possibly in a particular commit. Never mind that GitHub Actions is an unbelievable security nightma…
> PyPI could check the GitHub immutable tag, read the commit hash, and verify the whole chain of hashes from the files to the tree to the commit.
Tags are neither immutable nor durable on GitHub. This also breaks in the presence of any non-trivial build backend, including anything that produces a non-pure-Python wheel. Complexity is often bad, but just about every complex aspect of PyPI's attestation scheme has a reason behind it.