A better summary. [LWN.net]

A better summary.

Posted Jun 11, 2026 11:11 UTC (Thu) by kleptog (subscriber, #1183)
In reply to: A better summary. by LtWorf
Parent article: Eliminating long-lived credentials with trusted publishing

> Long lived upload tokens were never as problematic, to the best of my knowledge. The problem is doing uploads from a CI that runs god knows what.

So all the creds stolen in the Trivy compromise weren't a problem? Stolen Cisco code for example.

Doing uploads from CI/CD is very common. Even Debian publishes packages built from a build server. No-one has vetted all that code. Not relying on such tokens for common actions is an improvement.

to post comments

A better summary.

Posted Jun 11, 2026 16:10 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

The issue, AIUI, is that folks just "add secrets" to their pipelines willy-nilly. Even though we run our own CI infra, we still:

- restrict secrets to protected refs (so MR pipelines don't get them)
- only provided to named environments (so that build jobs don't get upload tokens)

These secret-using jobs tend to be of the "install rsync, run rsync"-level of complexity to keep even what runs with access to the secrets to a minimum.