|
| 1 | +--- |
| 2 | +title: Expanding Trusted Publisher Support |
| 3 | +description: Announcing additional Trusted Publishing providers |
| 4 | +authors: |
| 5 | + - di |
| 6 | +date: 2024-04-17 |
| 7 | +tags: |
| 8 | + - publishing |
| 9 | + - security |
| 10 | + - oidc |
| 11 | +--- |
| 12 | + |
| 13 | +Starting today, PyPI package maintainers can publish via Trusted Publishing |
| 14 | +from three additional providers: |
| 15 | + |
| 16 | + * GitLab CI/CD |
| 17 | + * Google Cloud |
| 18 | + * ActiveState |
| 19 | + |
| 20 | +These providers join existing support for publishing from GitHub Actions without |
| 21 | +long-lived passwords or API tokens, which [we announced last year], and bring |
| 22 | +support for Trusted Publishing to even more hosted providers. |
| 23 | + |
| 24 | +<!-- more --> |
| 25 | + |
| 26 | +### About Trusted Publishing |
| 27 | + |
| 28 | +Trusted Publishing is our term for using the [OpenID Connect (OIDC)] standard |
| 29 | +to exchange short-lived identity tokens between a trusted third-party service |
| 30 | +and PyPI. This method can be used in automated environments and eliminates the |
| 31 | +need to use username/password combinations or long-lived, manually generated |
| 32 | +API tokens to authenticate with PyPI when publishing. |
| 33 | + |
| 34 | +Instead, maintainers can configure PyPI to trust an identity provided by a |
| 35 | +given OpenID Connect Identity Provider (IdP). This allows allows PyPI to verify |
| 36 | +and delegate trust to that identity, which is then authorized to request |
| 37 | +short-lived, tightly-scoped API tokens from PyPI. These API tokens never need |
| 38 | +to be stored or shared, rotate automatically by expiring quickly, and provide a |
| 39 | +verifiable link between a published package and its source. |
| 40 | + |
| 41 | +### Get started today |
| 42 | + |
| 43 | +To get started with using trusted publishers on PyPI, see our documentation |
| 44 | +here: <https://docs.pypi.org/trusted-publishers/>. |
| 45 | + |
| 46 | +### Acknowledgements |
| 47 | + |
| 48 | +Funding for work implementing Google Cloud and GitLab support was provided by |
| 49 | +the Google Open Source Security Team, and much of the development work was |
| 50 | +performed by [Trail of Bits], with special thanks to contributors [William |
| 51 | +Woodruff] and [Facundo Tuesca]. |
| 52 | + |
| 53 | +ActiveState support was provided by ActiveState, with special thanks to |
| 54 | +contributors [Carey Hoffman] and [Pete Garcin]. |
| 55 | + |
| 56 | +--- |
| 57 | + |
| 58 | +_Dustin Ingram is a maintainer of the Python Package Index._ |
| 59 | + |
| 60 | +[we announced last year]: 2023-04-20-introducing-trusted-publishers.md |
| 61 | +[William Woodruff]: https://github.com/woodruffw |
| 62 | +[Facundo Tuesca]: https://github.com/facutuesca |
| 63 | +[Carey Hoffman]: https://github.com/th3coop |
| 64 | +[Pete Garcin]: https://github.com/rawktron |
| 65 | +[OpenID Connect (OIDC)]: https://openid.net/connect/ |
| 66 | +[Trail of Bits]: https://www.trailofbits.com/ |
0 commit comments