Trusted publishing: a new benchmark for packaging security
blog.trailofbits.com | blog | #supply-chain | #pypi | #authentication | #python | #package-management | #supply-chain-security | #trusted-publishing | #oidc | #credential-management | #ecosystem-security
Summary
Trail of Bits partnered with PyPI on trusted publishing, an OIDC-based auth method that removes long-lived API tokens, cutting supply chain attack and credential leak risks in package releases.
- Published
- Collected
--- id: 1663 title: "Trusted publishing: a new benchmark for packaging security" source_domain: blog.trailofbits.com source_url: "https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/" published_at: "2023-05-23T11:00:20Z" tags: ["supply-chain", "pypi", "authentication", "python", "package-management", "supply-chain-security", "trusted-publishing", "oidc", "credential-management", "ecosystem-security"] phying_url: "https://phying.com/item/1663" lang: en --- # Trusted publishing: a new benchmark for packaging security ## Summary Trail of Bits partnered with PyPI on trusted publishing, an OIDC-based auth method that removes long-lived API tokens, cutting supply chain attack and credential leak risks in package releases. ## Intelligence Metadata - **Sources:** blog.trailofbits.com - **Published:** 2023-05-23T11:00:20Z - **Original:** https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/ - **Phying News:** https://phying.com/item/1663