A few weeks ago, PyPI introduced the concept of Trusted Publishers into their ecosystem for their developers to enable better security measures for deployment of updated packages.
I was hoping to start the discussion here of whether it may be worth implementing a similar system in Hex.pm to help improve the security of the publishing packages from CI!
Trusted Publishers / TL;DR
It utilizes the OpenID Connect standard to exchange short-lived identity tokens between a trusted third-party service and PyPI. It eliminates the need for long-lived passwords or API tokens to be shared with external systems.
With trusted publishing, PyPI maintainers can configure PyPI to trust an identity provided by a specific OpenID Connect Identity Provider. This allows PyPI to verify and delegate trust to that identity, which is then authorized to request short-lived, tightly-scoped API tokens from PyPI. These API tokens do not need to be stored or shared, expire quickly, and provide a verifiable link between a published package and its source.
Trusted publishing for PyPI only works with GitHub Actions for now. But it allows package maintainers to be able to configure PyPI to trust a GitHub repository and workflow, enabling users of the pypi-publish GitHub Action to adopt trusted publishing. By removing the username and password fields from the workflow configuration and adding permissions to generate an identity token, PyPI publishing can be performed securely without the need for long-lived credentials.
A few weeks ago, PyPI introduced the concept of Trusted Publishers into their ecosystem for their developers to enable better security measures for deployment of updated packages.
I was hoping to start the discussion here of whether it may be worth implementing a similar system in Hex.pm to help improve the security of the publishing packages from CI!
Trusted Publishers / TL;DR
It utilizes the OpenID Connect standard to exchange short-lived identity tokens between a trusted third-party service and PyPI. It eliminates the need for long-lived passwords or API tokens to be shared with external systems.
With trusted publishing, PyPI maintainers can configure PyPI to trust an identity provided by a specific OpenID Connect Identity Provider. This allows PyPI to verify and delegate trust to that identity, which is then authorized to request short-lived, tightly-scoped API tokens from PyPI. These API tokens do not need to be stored or shared, expire quickly, and provide a verifiable link between a published package and its source.
Trusted publishing for PyPI only works with GitHub Actions for now. But it allows package maintainers to be able to configure PyPI to trust a GitHub repository and workflow, enabling users of the
pypi-publishGitHub Action to adopt trusted publishing. By removing the username and password fields from the workflow configuration and adding permissions to generate an identity token, PyPI publishing can be performed securely without the need for long-lived credentials.