←back to thread

PyPI now supports digital attestations

(blog.pypi.org)
218 points miketheman | 1 comments | 14 Nov 24 14:25 UTC | HN request time: 0.206s | source
Show context
ashvardanian ◴[14 Nov 24 14:59 UTC] No.42136739[source]▶
Here is the GitHub issue you can subscribe to for automatically generated attestations in the GitHub CI PyPi upload action: https://github.com/pypa/gh-action-pypi-publish/issues/288
replies(1): >>42136782 #
1. woodruffw ◴[14 Nov 24 15:02 UTC] No.42136782[source]▶
Just a note: that issue is for connecting the already-present attestations to GitHub's attestations feature[1]. Attestations are already automatically generated and uploaded to PyPI regardless of that issue.

(That issue will still be great to resolve, but just to avoid any confusion about its scope.)

[1]: https://docs.github.com/en/actions/security-for-github-actio...