Skip to main content

Automatic trusted publishing with PyPI

30 minutes


PyPI added support for “Trusted Publishing” last year, allowing package maintainers to create releases directly from their GitHub Actions pipelines without having to worry about token management. Trusted Publishing removes long-lived API tokens from the equation, removing a threat vector for supply chain attacks. In this talk, we’ll go through the details of how this works, how maintainers can easily take advantage of it with minimal changes to their existing setup, and the ongoing effort in the last 12 months to add support for publishers other than GitHub, such as GitLab, Google, and ActiveState.

The speaker

Facundo Tuesca

Facundo Tuesca

I’m a Senior Security Engineer at Trail of Bits, currently focused on improving open-source ecosystem security, mainly through contributions to foundational packages in the Python ecosystem.