Hacker News Reader

Full thread

cpburns2009

Great, now how do you use attestations with Twine when publishing packages on PyPI outside of the Github ecosystem?

View on HN

You don't. The whole point is that you can no longer sign anything. Microsoft signs for you.

And of course the signature means "this user can push to github" and nothing more.

Hopefully the attestation is bound to a specific commit, so you can know the binaries came from the source?

Otherwise I don't get it.

It doesn't seem to be from what I can see. Only states that the upload came from a gh runner.

See adjacent comment above.

Ok that's at least something.

But my CI can download and run code from everywhere, so that doesn't mean that I can know what is being uploaded just looking at the git repository alone.

Yes, it’s bound to a specific commit; we just don’t present that in the web UI yet. If you click on the transparency log entry, you’ll see the exact commit the attestation came from.

You need to rely on one of the four trusted publishers. You can't do it yourself: https://docs.pypi.org/trusted-publishers/adding-a-publisher/

Reply on news.ycombinator.com