A better summary.
A better summary.
Posted Jun 10, 2026 19:36 UTC (Wed) by LtWorf (subscriber, #124958)In reply to: A better summary. by mathstuf
Parent article: Eliminating long-lived credentials with trusted publishing
If Debian can be reproducible, i suspect that most .py and .js projects can be as well.
Github actions are a mess. Builds should run without network access as a minimum condition. And PyPI should probably require projects to be able to build.
That's not what happens at all.
I agree that a long lived token sitting on a developer's machine can be compromised.
However it can happen to their ssh keys too. But we wouldn't necessarily care if the github action to build a package was standardised and ran without network access at the very least.
We are defending against a very minor attack and ignoring all the rest. If this wasn't in the threat modelling… perhaps the threat modelling was bad as well?